Vulnerability Description
The rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to cause a denial of service (memory corruption) and execute arbitrary code via vectors related to the (1) GetGlobalSettings or (2) GetSiteProperties3 methods, which triggers a dereference of an arbitrary memory address. NOTE: this issue was MERGED with CVE-2014-0606 because it is the same type of vulnerability, affecting the same set of versions, and discovered by the same researcher.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Attachmate | Reflection Ftp Client | <= 14.1.420 |
Related Weaknesses (CWE)
References
- http://support.attachmate.com/techdocs/2501.htmlVendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-14-288/
- http://www.zerodayinitiative.com/advisories/ZDI-14-291/
- http://support.attachmate.com/techdocs/2501.htmlVendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-14-288/
- http://www.zerodayinitiative.com/advisories/ZDI-14-291/
FAQ
What is CVE-2014-0603?
CVE-2014-0603 is a vulnerability with a CVSS score of 10.0 (HIGH). The rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to cause a denial of service (memory corruption) and execute arbitrary code via vectors rela...
How severe is CVE-2014-0603?
CVE-2014-0603 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-0603?
Check the references section above for vendor advisories and patch information. Affected products include: Attachmate Reflection Ftp Client.