Hfiref0X
Monthly
Unauthenticated remote denial of service in LightFTP through version 2.4 exploits multiple data race conditions in ftpserv.c via the LIST/ABOR command sequence. The control thread closes shared data_socket and file_fd descriptors while worker threads concurrently reference the same fields in worker_thread_cleanup, enabling the OS to reassign stale descriptors to unrelated resources and producing undefined behavior. A publicly available proof-of-concept exists (GitHub issue #75); exploitation has not been confirmed in the wild (not in CISA KEV), but the unauthenticated attack surface and CVSS 4.0 score of 8.2 elevate urgency for exposed deployments.
A buffer overflow in the g_cfg.MaxUsers component of LightFTP v2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
A race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
LightFTP version 1.1 is vulnerable to a buffer overflow in the "writelogentry" function resulting a denial of services or a remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote denial of service in LightFTP through version 2.4 exploits multiple data race conditions in ftpserv.c via the LIST/ABOR command sequence. The control thread closes shared data_socket and file_fd descriptors while worker threads concurrently reference the same fields in worker_thread_cleanup, enabling the OS to reassign stale descriptors to unrelated resources and producing undefined behavior. A publicly available proof-of-concept exists (GitHub issue #75); exploitation has not been confirmed in the wild (not in CISA KEV), but the unauthenticated attack surface and CVSS 4.0 score of 8.2 elevate urgency for exposed deployments.
A buffer overflow in the g_cfg.MaxUsers component of LightFTP v2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
A race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
LightFTP version 1.1 is vulnerable to a buffer overflow in the "writelogentry" function resulting a denial of services or a remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.