CVE-2003-0963

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-01-05 · updated 2026-06-16

Description

Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary code via long directory names that are processed by the ls or rels commands.

Affected products

Alexander V. Lukyanov Lftp: 2.3, 2.4.9, 2.5.2, 2.6.0, 2.6.3, 2.6.4 (+5)

References

http://marc.info/?l=bugtraq&m=107126386226196&w=2
http://marc.info/?l=bugtraq&m=107152267121513&w=2
http://marc.info/?l=bugtraq&m=107167974714484&w=2
http://marc.info/?l=bugtraq&m=107177409418121&w=2
http://marc.info/?l=bugtraq&m=107340499504411&w=2
http://secunia.com/advisories/10525
http://secunia.com/advisories/10548
http://www.debian.org/security/2004/dsa-406
http://www.mandriva.com/security/advisories?name=MDKSA-2003:116
http://www.novell.com/linux/security/advisories/2003_051_lftp.html

Get alerted when CVE-2003-0963 or the next vulnerability affects your stack