{"id":"CVE-2003-0466","aliases":["DEBIAN-CVE-2003-0466","DSA-357","EUVD-2003-0460","GHSA-7c4w-gm97-vgqq"],"status":"published","title":"Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may...","description":"Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.78115,"percentile":0.99579,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-193"],"published":"2003-07-31T00:00:00Z","modified":"2026-06-16T22:02:15Z","exploits":[{"source":"exploitdb","id":"EDB-22974","title":"WU-FTPD 2.6.2 - 'realpath()' Off-by-One Buffer Overflow","type":"remote","platform":"unix","date":"2003-08-02","verified":true,"url":"https://www.exploit-db.com/exploits/22974"},{"source":"exploitdb","id":"EDB-22975","title":"WU-FTPD 2.6.0/2.6.1/2.6.2 - 'realpath()' Off-by-One Buffer Overflow","type":"remote","platform":"unix","date":"2003-08-06","verified":true,"url":"https://www.exploit-db.com/exploits/22975"},{"source":"exploitdb","id":"EDB-22976","title":"FreeBSD 4.8 - 'realpath()' Off-by-One Buffer Overflow","type":"remote","platform":"freebsd","date":"2003-07-31","verified":true,"url":"https://www.exploit-db.com/exploits/22976"},{"source":"exploitdb","id":"EDB-74","title":"WU-FTPD 2.6.2 - Off-by-One Remote Command Execution","type":"remote","platform":"linux","date":"2003-08-03","verified":true,"url":"https://www.exploit-db.com/exploits/74"},{"source":"exploitdb","id":"EDB-78","title":"WU-FTPD 2.6.2 - Remote Command Execution","type":"remote","platform":"linux","date":"2003-08-11","verified":true,"url":"https://www.exploit-db.com/exploits/78"}],"fixes":[{"ecosystem":"Debian:3.0","package":"wu-ftpd","fixed_in":["2.6.2-3woody1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:3.0","package":"wu-ftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-3woody1"}]}]}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"mac_os_x_server"},{"vendor":"freebsd","product":"freebsd"},{"vendor":"netbsd","product":"netbsd"},{"vendor":"openbsd","product":"openbsd"},{"vendor":"redhat","product":"wu_ftpd"},{"vendor":"sun","product":"solaris"},{"vendor":"wuftpd","product":"wu-ftpd"}],"references":[{"url":"http://marc.info/?l=bugtraq\u0026m=106002488209129\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List"]},{"url":"http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.txt","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/9446","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://www.osvdb.org/6602","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1970","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/archive/1/424852/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/8315","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Exploit","Patch","Third Party Advisory","VDB Entry","Vendor Advisory"]},{"url":"http://secunia.com/advisories/9423","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://marc.info/?l=bugtraq\u0026m=105967301604815\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List"]},{"url":"http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0065.html","tags":["mailing-list","x_refsource_VULNWATCH","x_transferred","Broken Link","Exploit","Vendor Advisory"]},{"url":"http://download.immunix.org/ImmunixOS/7+/Updates/errata/IMNX-2003-7+-019-01","tags":["vendor-advisory","x_refsource_IMMUNIX","x_transferred","Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2003-246.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/archive/1/425061/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.kb.cert.org/vuls/id/743092","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"http://www.redhat.com/support/errata/RHSA-2003-245.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link"]},{"url":"http://www.novell.com/linux/security/advisories/2003_032_wuftpd.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1001257.1-1","tags":["vendor-advisory","x_refsource_SUNALERT","x_transferred","Broken Link"]},{"url":"http://www.debian.org/security/2003/dsa-357","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Broken Link"]},{"url":"http://marc.info/?l=bugtraq\u0026m=106001702232325\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List"]},{"url":"http://securitytracker.com/id?1007380","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2003:080","tags":["vendor-advisory","x_refsource_MANDRAKE","x_transferred","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/12785","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://marc.info/?l=bugtraq\u0026m=106001410028809\u0026w=2","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","Mailing List"]},{"url":"http://www.turbolinux.com/security/TLSA-2003-46.txt","tags":["vendor-advisory","x_refsource_TURBO","x_transferred","Broken Link"]},{"url":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-011.txt.asc","tags":["vendor-advisory","x_refsource_NETBSD","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/9535","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/9447","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2003-0466"},{"url":"https://github.com/advisories/GHSA-7c4w-gm97-vgqq"}],"sources":{"cve":[{"id":"CVE-2003-0466","description":"Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.","status":"published","published":"2003-08-01T04:00:00Z","modified":"2024-08-08T01:58:10.161Z","updated_at":"2026-11-02T14:20:16.757505Z"}],"euvd":[{"id":"EUVD-2003-0460","description":"Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.","status":"published","published":"2003-08-01T04:00:00Z","modified":"2024-08-08T01:58:10Z","updated_at":"2026-11-03T01:15:07.267875Z"}],"ghsa":[{"id":"GHSA-7c4w-gm97-vgqq","title":"Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may...","description":"Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.","status":"published","published":"2022-05-03T03:09:43Z","modified":"2023-02-01T05:01:04Z","updated_at":"2026-11-02T14:49:39.648637Z"}],"nvd":[{"id":"CVE-2003-0466","description":"Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO.","status":"published","published":"2003-08-27T04:00:00Z","modified":"2026-06-16T22:02:15.263Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:00:47.41445Z"}],"osv":[{"id":"DSA-357","title":"wu-ftpd - remote root exploit","status":"published","published":"2003-07-31T00:00:00Z","modified":"2026-03-09T01:22:21.293497Z","updated_at":"2026-11-02T15:46:16.199525Z"}]}}