Vulnerability record · CVE-2005-3683 · published 19 November 2005
CVE-2005-3683: freeFTPd logging stack buffer overflow via long USER command
Freeftpd · Freeftpd
freeFTPd before 1.0.9 contains a stack-based buffer overflow that is reachable when logging is enabled. A remote attacker can send an oversized USER command to crash the service and possibly execute arbitrary code. The flaw matters because it is network-reachable without authentication and the affected FTP service is often exposed.
Description
Stack-based buffer overflow in freeFTPd before 1.0.9 with Logging enabled, allows remote attackers to cause a denial of service (application crash), and possibly execute arbitrary code, via a long USER command.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityThe vulnerability is remotely exploitable without authentication, has a high EPSS score and public exploit references, and can lead to code execution, though it requires logging to be enabled and the product is legacy.
What it is
freeFTPd before 1.0.9 contains a stack-based buffer overflow that is reachable when logging is enabled. A remote attacker can send an oversized USER command to crash the service and possibly execute arbitrary code. The flaw matters because it is network-reachable without authentication and the affected FTP service is often exposed.
Impact
An attacker can cause a denial of service by crashing the FTP daemon and may be able to execute arbitrary code in the context of the service. Successful code execution would give the attacker the privileges of the freeFTPd process.
Attack surface
The flaw is reached over the network through the FTP service by sending a long USER command; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is required. No user interaction is needed, but the description states logging must be enabled for the overflow to occur.
Exploitation
CISA KEV does not list this CVE, but EPSS is high at roughly 0.715 (99th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.
What to do
- Upgrade freeFTPd to version 1.0.9 or later, which the vendor changelog and patch-tagged references indicate fixes the issue.
- If upgrading is not immediately possible, disable logging or restrict access to the FTP service to trusted networks only.
- Place the FTP service behind a firewall or access control list so untrusted clients cannot reach the USER command handler.
- Monitor vendor and OSVDB advisories for the official patch and apply it as soon as it is available.
Detection
- Inspect FTP server logs for USER commands containing unusually long or non-printable arguments.
- Monitor for freeFTPd process crashes or unexpected restarts that correlate with FTP connection activity.
- Alert on repeated FTP connection attempts from a single source that send oversized commands.
- Use network IDS signatures for long USER command strings targeting port 21.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-3683 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-3683), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
