Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

OpenFTPD lets logged‑in users run their own code

CVE-2004-2523 · published 21 years ago
Summary

Versions of the OpenFTPD FTP server up to 0.30.2 have a mistake in how they handle the “msg” command. A user who has already logged in can exploit this to make the server run any program they choose, potentially taking control of the system. Update the server to the latest version or apply the vendor’s patch, and limit who can log in until then.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
openftpd openftpd_ftp_server <= 0.30.2
0.29.4
0.30
0.30.1
cpe:2.3:a:openftpd:openftpd_ftp_server:*:*:*:*:*:*:*:*
Original advisory text
Format string vulnerability in the msg command (cat_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated users to execute arbitrary code via format string specifier...
Format string vulnerability in the msg command (cat_message function in msg.c) in OpenFTPD 0.30.2 and earlier allows remote authenticated users to execute arbitrary code via format string specifiers in the message argument.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
5% chance of attack within 30 days
Timeline
Published31 Dec 2004
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2004-2523 · NVD
Track software like this
Free during beta