What is CVE-2020-5204?

CVE-2020-5204 is a medium-severity vulnerability in Troglobit Uftpd, classified under Stack-based Buffer Overflow. CVSS score: 6.5/10. Published 2020-01-06.

How severe is CVE-2020-5204?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Buffer overflow in Troglobit Uftpd

CVE-2020-5204

In uftpd before 2.11, there is a buffer overflow vulnerability in handle_PORT in ftpcmd.c that is caused by a buffer that is 16 bytes large being filled via sprintf() with user input based on the format specifier string %d.%d.%d.%d. The 16 byte size is correct for valid IPv4 addresses (len('255.255.255.255') == 16), but the format specifier %d allows more than 3 digits. This has been fixed in version 2.11

Vulnerability class: Buffer Overflow

EPSS: 0.011 (61.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L.

Affected products

Troglobit Uftpd — versions < 2.11

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
security-advisories@github.com (vendor-advisory, x_refsource_SUSE)

Frequently asked questions

What is CVE-2020-5204?: CVE-2020-5204 is a medium-severity vulnerability in Troglobit Uftpd, classified under Stack-based Buffer Overflow. CVSS score: 6.5/10. Published 2020-01-06.
How severe is CVE-2020-5204?: Medium severity. CVSS v3 base score is 6.5 out of 10.