CVE-2012-10023

CRITICAL 9.8CVE-2012-10023 · Published 05/08/2025 · updated 16/06/2026

Package	Affected versions	Patched versions
freefloat ftp server freefloat	`= 1.0`	No fix yet

Description

A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which overflows the buffer allocated for user authentication.

References

my.saintcorporation.com/cgi-bin/exploit_info/freefloat_ftp_server_user_cmd · Third Party Advisory
raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/freefloatftp_user.rb · Exploit
web.archive.org/web/20101208040029/http://secunia.com/advisories/42465 · Third Party Advisory
web.archive.org/web/20101213050627/http://www.freefloat.com/sv/about-/about-.php · Product
exploit-db.com/exploits/15689 · Exploit
exploit-db.com/exploits/23243 · Exploit
vulncheck.com/advisories/freefloat-ftp-server-user-command-buffer-overflow · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free