CVE-2020-5204

Name of the Vulnerable Software and Affected Versions uftpd versions prior to 2.11

Description The issue is caused by a buffer overflow in the handle PORT function in ftpcmd.c. This occurs when a 16-byte buffer is filled with user input via sprintf() using the format specifier string %d.%d.%d.%d. Although the 16-byte size is sufficient for valid IPv4 addresses, the %d format specifier allows for more than 3 digits, leading to a potential overflow.

Recommendations For versions prior to 2.11, update to version 2.11 to resolve the issue.