CVE-2004-0159 Other in n/a
Authenticated remote attackers can cause denial of service or execute arbitrary code via format string characters in filenames during ls commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-0159?
CVE-2004-0159 is a high-severity vulnerability in n/a, published on 1 Sep 2004. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Format string vulnerability in hsftp 1.11 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via file names containing format string characters that are not properly handled when executing an "ls" command.
Which versions are affected by CVE-2004-0159?
It affects 1 product.
Products include Samhain Labs Hsftp.
How do I fix CVE-2004-0159?
Apply the vendor's patch.
Is CVE-2004-0159 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-0159 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DSA-447, GHSA-7v4p-3v84-r8mc.