CVE-2013-4730

CVE-2013-4730

EPSS 67.2%

Vexday Risk Score

50Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Popular PoC on GitHub (2 stars) — exploitation code widely available.

CVSS —EPSS 67.2%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

27 Jun 2013Metasploit module available

30 Jun 2013Public PoC

15 May 2014Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.

Affected products

public PoCs found — 12

githubgithub.com/t0rt3ll1n0/PCmanBoF★ 2 exploitdbwww.exploit-db.com/exploits/26495unverified exploitdbwww.exploit-db.com/exploits/36078unverified exploitdbwww.exploit-db.com/exploits/38013unverified exploitdbwww.exploit-db.com/exploits/27007unverified exploitdbwww.exploit-db.com/exploits/31254unverified exploitdbwww.exploit-db.com/exploits/31255unverified exploitdbwww.exploit-db.com/exploits/27277unverified exploitdbwww.exploit-db.com/exploits/28328unverified exploitdbwww.exploit-db.com/exploits/31789unverified cve_referencewww.exploit-db.com/exploits/26471unverified exploitdbwww.exploit-db.com/exploits/27703unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://infosec42.blogspot.com/2013/06/unauthenticated-pcman-ftp-207-buffer.html http://osvdb.org/show/osvdb/94624 http://www.exploit-db.com/exploits/26471 http://www.securityfocus.com/bid/60837