CVE-2019-25588

EUVD-2019-19918
BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the DNS Address field that allows local attackers to crash the application by supplying an excessively long string. Attackers can enable the DNS Address option in the Firewall settings and paste a buffer of 700 bytes to trigger a crash when the Test function is invoked.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.2 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
VulnCheckCNA
6.2 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
bpftpserverbulletproof_ftp_server
2019.0.0.50
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://bpftpserver.com/
http://bpftpserver.com/products/bpftpserver/windows/download
https://www.exploit-db.com/exploits/46875
https://www.vulncheck.com/advisories/bulletproof-ftp-server-denial-of-service-via-dns-address