Xlight Ftp Server
Monthly
Remote code execution in Xlight FTP Server versions before 3.9.5 allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets once an AES-GCM cipher is negotiated during the SSH/SFTP handshake. An unvalidated length field is passed directly to the GCM decrypt routine, overwriting the stack cookie and saved return address before any authentication occurs, potentially yielding code execution as the FTP service. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the pre-auth, network-reachable nature makes it a high priority.
Pre-authentication heap buffer overflow in Xlight FTP Server before 3.9.5 lets remote unauthenticated attackers write past a heap buffer by sending a malformed SSH client identification string over any SSH or SFTP connection. The flaw is a logic error in the recv-loop termination condition (an OR used where AN AND is required), triggering before authentication and creating strong potential for remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Xlight FTP Server before 3.9.5 on Windows leaks the system's GetTickCount() value to unauthenticated remote attackers via the standard FTP listener. Sending a USER command with a username ending in the :adm suffix triggers an internal admin protocol code path pre-authentication, causing the server to embed Windows timing data in the FTP 331 response - no separate admin port or configuration change required. No active exploitation is confirmed (not in CISA KEV), but the attack is trivially executable against any default installation with network access to the FTP port.
A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in Xlight FTP Server versions before 3.9.5 allows unauthenticated attackers to corrupt stack memory by sending malformed SSH packets once an AES-GCM cipher is negotiated during the SSH/SFTP handshake. An unvalidated length field is passed directly to the GCM decrypt routine, overwriting the stack cookie and saved return address before any authentication occurs, potentially yielding code execution as the FTP service. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the pre-auth, network-reachable nature makes it a high priority.
Pre-authentication heap buffer overflow in Xlight FTP Server before 3.9.5 lets remote unauthenticated attackers write past a heap buffer by sending a malformed SSH client identification string over any SSH or SFTP connection. The flaw is a logic error in the recv-loop termination condition (an OR used where AN AND is required), triggering before authentication and creating strong potential for remote code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Xlight FTP Server before 3.9.5 on Windows leaks the system's GetTickCount() value to unauthenticated remote attackers via the standard FTP listener. Sending a USER command with a username ending in the :adm suffix triggers an internal admin protocol code path pre-authentication, causing the server to embed Windows timing data in the FTP 331 response - no separate admin port or configuration change required. No active exploitation is confirmed (not in CISA KEV), but the attack is trivially executable against any default installation with network access to the FTP port.
A vulnerability classified as problematic was found in Xlightftpd Xlight FTP Server 1.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.