CVE-2019-25681 - Vulnerability Analysis

Overview

Xlight FTP Server 3.9.1 contains a buffer overflow caused by crafted buffer string in the virtual server configuration execution field, letting local attackers overwrite SEH pointers and potentially execute code.

Severity & Score

Impact

Local attackers can crash the application and potentially execute arbitrary code by corrupting SEH pointers.

Mitigation

Update to the latest version of Xlight FTP Server.

References

• https://www.exploit-db.com/exploits/46458
• https://www.vulncheck.com/advisories/xlight-ftp-server-seh-overwrite-buffer-overflow
• https://www.xlightftpd.com/download/xlight.zip
• https://www.xlightftpd.com/index.htm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner