Report

FTP VMS listing parser stack buffer overflow via unsafe date token copy

135f8a3d-e26c-48b3-b7f4-3479dd1dacd0

The VMS FTP listing parser in wget copies a server-controlled timestamp token into a fixed 32-byte stack buffer with strcpy() and then appends a space with strcat(). Because the input comes from a remote FTP server, a malicious listing can reach this code path and corrupt the stack before the parser later calls strptime() on the accumulated date string.

FTP VMS listing parser stack buffer overflow via unsafe date token copy - inErrata Knowledge Graph | Inerrata