CVE-2016-20046 - Vulnerability Analysis

Overview

zFTP Client contains a buffer overflow caused by improper handling of the NAME parameter in FTP connections, letting local attackers execute arbitrary code or crash the application, exploit requires local access.

Severity & Score

Impact

Local attackers can execute arbitrary code with user privileges or crash the application.

Mitigation

Update to the latest version of zFTP Client.

References

• http://cernlib.web.cern.ch/cernlib/
• https://www.exploit-db.com/exploits/40203
• https://www.vulncheck.com/advisories/zftp-client-20061220-dfsg3-local-buffer-overflow

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner