CVE-2011-5166

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-09-15 · updated 2026-06-16
Weakness: CWE-119

Description

Multiple stack-based buffer overflows in KnFTP 1.0.0 allow remote attackers to execute arbitrary code via a long string to the (1) USER, (2) PASS, (3) REIN, (4) QUIT, (5) PORT, (6) PASV, (7) TYPE, (8) STRU, (9) MODE, (10) RETR, (11) STOR, (12) APPE, (13) ALLO, (14) REST, (15) RNFR, (16) RNTO, (17) ABOR, (18) DELE, (19) CWD, (20) LIST, (21) NLST, (22) SITE, (23) STST, (24) HELP, (25) NOOP, (26) MKD, (27) RMD, (28) PWD, (29) CDUP, (30) STOU, (31) SNMT, (32) SYST, and (33) XPWD commands.

Affected products

Elif Keir Knftp: 1.0.0

References

http://archives.neohapsis.com/archives/bugtraq/2011-09/0015.html
http://secunia.com/advisories/45907
http://www.exploit-db.com/exploits/17819
http://www.exploit-db.com/exploits/17856
http://www.exploit-db.com/exploits/17870
http://www.exploit-db.com/exploits/18089
http://www.osvdb.org/75147
https://exchange.xforce.ibmcloud.com/vulnerabilities/69557
http://archives.neohapsis.com/archives/bugtraq/2011-09/0015.html
http://secunia.com/advisories/45907
http://www.exploit-db.com/exploits/17819
http://www.exploit-db.com/exploits/17856

Get alerted when CVE-2011-5166 or the next vulnerability affects your stack