CVE-2012-10023

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-10023
A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmd Third Party Advisory
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rb Exploit
https://web.archive.org/web/20101208040029/http://secunia.com/advisories/42465/ Third Party Advisory
https://web.archive.org/web/20101213050627/http://www.freefloat.com/sv/about-/about-.php Product
https://www.exploit-db.com/exploits/15689 Exploit
https://www.exploit-db.com/exploits/23243 Exploit
https://www.vulncheck.com/advisories/freefloat-ftp-server-user-command-buffer-overflow Third Party Advisory
https://www.exploit-db.com/exploits/23243 Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:freefloat:freefloat_ftp_server:1.0:*:*:*:*:*:*:*
History

03 Sep 2025, 14:58

Type Values Removed Values Added
References () https://my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmd - () https://my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmd - Third Party Advisory
References () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rb - () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rb - Exploit
References () https://web.archive.org/web/20101208040029/http://secunia.com/advisories/42465/ - () https://web.archive.org/web/20101208040029/http://secunia.com/advisories/42465/ - Third Party Advisory
References () https://web.archive.org/web/20101213050627/http://www.freefloat.com/sv/about-/about-.php - () https://web.archive.org/web/20101213050627/http://www.freefloat.com/sv/about-/about-.php - Product
References () https://www.exploit-db.com/exploits/15689 - () https://www.exploit-db.com/exploits/15689 - Exploit
References () https://www.exploit-db.com/exploits/23243 - () https://www.exploit-db.com/exploits/23243 - Exploit
References () https://www.vulncheck.com/advisories/freefloat-ftp-server-user-command-buffer-overflow - () https://www.vulncheck.com/advisories/freefloat-ftp-server-user-command-buffer-overflow - Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:freefloat:freefloat_ftp_server:1.0:*:*:*:*:*:*:*
First Time Freefloat freefloat Ftp Server
Freefloat

06 Aug 2025, 18:15

Type Values Removed Values Added
References () https://www.exploit-db.com/exploits/23243 - () https://www.exploit-db.com/exploits/23243 -
Summary
  • (es) Existe una vulnerabilidad de desbordamiento de búfer en la pila en FreeFloat FTP Server version 1.0.0. El servidor no valida correctamente la entrada enviada al comando USER, lo que permite a atacantes remotos sobrescribir la memoria y potencialmente ejecutar código arbitrario. La falla se activa al enviar una cadena de nombre de usuario demasiado larga, lo que desborda el búfer asignado para la autenticación de usuarios.

05 Aug 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-05 20:15

Updated : 2025-09-03 14:58

NVD link : CVE-2012-10023

Mitre link : CVE-2012-10023

CVE.ORG link : CVE-2012-10023

JSON object : View

Products Affected

freefloat

  • freefloat_ftp_server
CWE
CWE-121

Stack-based Buffer Overflow