CVE-2016-5764 Memory corruption in Micro Focus Rumba FTP 4.X before 4.5 (HF 14668)
A buffer overflow in the Rumba FTP client allows arbitrary code execution when connecting to a malicious server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2016-5764?
CVE-2016-5764 is a high-severity memory corruption vulnerability in Micro Focus Rumba FTP 4.X before 4.5 (HF 14668), published on 27 Oct 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Micro Focus Rumba FTP 4.X client buffer overflow makes it possible to corrupt the stack and allow arbitrary code execution. Fixed in: Rumba FTP 4.5 (HF 14668). This can only occur if a client connects to a malicious server.
Weakness: CWE-119
Which versions are affected by CVE-2016-5764?
It affects 1 product.
Products include Microfocus Rumba Ftp.
How do I fix CVE-2016-5764?
No fix has been published for CVE-2016-5764 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-5764 being exploited?
There is no known exploitation of CVE-2016-5764 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-h9q9-mg45-rm27.