Vulnerability Scanning Solutions, LLC.
Our Process
What We Scan For
Sample Report
Client List
Contact Us
What We Scan For
Family: Red Hat Local Security Checks --> Category: infos

RHSA-2003-404: lftp Vulnerability Scan

Vulnerability Scan Summary
Check for the version of the lftp packages

Detailed Explanation for this Vulnerability Test

Updated lftp packages are now available that fix a buffer overflow
security vulnerability.

lftp is a command-line file transfer program supporting FTP and HTTP

Ulf Härnhammar discovered a buffer overflow bug in versions of lftp up to
and including 2.6.9. A possible hacker could create a carefully crafted
directory on a website such that, if a user connects to that directory
using the lftp client and subsequently issues a 'ls' or 'rels' command, the
attacker could execute arbitrary code on the users machine. The Common
Vulnerabilities and Exposures project ( has assigned the name
CVE-2003-0963 to this issue.

Users of lftp are advised to upgrade to these erratum packages, which
contain a backported security patch and are not vulnerable to this issue.

Red Hat would like to thank Ulf Härnhammar for discovering and alerting us
to this issue.

Solution :
Threat Level: High

Click HERE for more information and discussions on this network vulnerability scan.


P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.