OSVDB ID: 4029 Title: Hsftp Filename Format String |
Info |
|
|
Dates |
||||
|
|
Description |
Hsftp contains a flaw that may allow a malicious user to execute arbitrary code on the client machine. The issue is triggered when the client user lists the contents of a directory which contains a maliciously crafted filename. It is possible that the flaw may allow execution of arbitrary code resulting in a loss of confidentiality and integrity. |
Classification |
Location:
Local Access Required,
Remote / Network Access,
Local / Remote,
Context Dependent
Attack Type: Input Manipulation Impact: Loss of Confidentiality, Loss of Integrity Exploit: Exploit Rumored |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. Users of Hsftp 1.14 are counseled to connect only to trusted servers. |
Products |
|
References |
Credit |
|