CVE-2001-1021

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Buffer overflows in WS_FTP 2.02 allow remote attackers to execute arbitrary code via long arguments to (1) DELE, (2) MDTM, (3) MLST, (4) MKD, (5) RMD, (6) RNFR, (7) RNTO, (8) SIZE, (9) STAT, (10) XMKD, or (11) XRMD.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2001-07/0610.htmlExploit, Patch, Vendor Advisory
http://www.ipswitch.com/Support/WS_FTP-Server/patch-upgrades.htmlPatch
https://exchange.xforce.ibmcloud.com/vulnerabilities/6911
http://archives.neohapsis.com/archives/bugtraq/2001-07/0610.htmlExploit, Patch, Vendor Advisory
http://www.ipswitch.com/Support/WS_FTP-Server/patch-upgrades.htmlPatch
https://exchange.xforce.ibmcloud.com/vulnerabilities/6911

Timeline

Published: Jul 26, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-10227.5Format string vulnerability in pic utility in groff 1.16.1 and other versions, and jgroff before 1.15, allows remote attackers to bypass the CVE-2001-10235.0Xcache 2.1 allows remote attackers to determine the absolute path of web server documents by requesting a URL that is not cached by Xcache, CVE-2001-10247.5login.gas.bat and other CGI scripts in Entrust getAccess allow remote attackers to execute Java programs, and possibly arbitrary commands, b CVE-2001-102510.0PHP-Nuke 5.x allows remote attackers to perform arbitrary SQL operations by modifying the "prefix" variable when calling any scripts that do CVE-2001-10267.5Trend Micro InterScan AppletTrap 2.0 does not properly filter URLs when they are modified in certain ways such as (1) using a double slash (CVE-2001-102710.0Buffer overflow in WindowMaker (aka wmaker) 0.64 and earlier allows remote attackers to execute arbitrary code via a long window title.CVE-2001-10287.2Buffer overflow in ultimate_source function of man 1.5 and earlier allows local users to gain privileges.CVE-2001-10292.1libutil in OpenSSH on FreeBSD 4.4 and earlier does not drop privileges before verifying the capabilities for reading the copyright and welco CVE-2001-10307.5Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_accel_host and http_accel_with_p CVE-2001-10315.0Directory traversal vulnerability in Meteor FTP 1.0 allows remote attackers to read arbitrary files via (1) a .. (dot dot) in the ls/LIST co CVE-2001-10327.5admin.php in PHP-Nuke 5.2 and earlier, except 5.0RC1, does not check login credentials for upload operations, which allows remote attackers CVE-2001-10335.0Compaq TruCluster 1.5 allows remote attackers to cause a denial of service via a port scan from a system that does not have a DNS PTR record