Vulnerability record · CVE-2010-3972 · published 23 December 2010
CVE-2010-3972: Microsoft IIS FTP Service heap buffer overflow via crafted FTP command
Microsoft · Internet Information Services
A heap-based buffer overflow exists in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 as shipped with IIS 7.0 and 7.5. A remote attacker can trigger it with a crafted FTP command, leading to arbitrary code execution or a daemon crash. The flaw is remotely reachable and requires no authentication.
Description
Heap-based buffer overflow in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) 7.0, and IIS 7.5, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted FTP command, aka "IIS FTP Service Heap Buffer Overrun Vulnerability." NOTE: some of these details are obtained from third party information.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 base score of 10 with network reachability, no authentication, full confidentiality/integrity/availability impact, and public exploit code make this a top-priority fix.
What it is
A heap-based buffer overflow exists in the TELNET_STREAM_CONTEXT::OnSendData function in ftpsvc.dll in Microsoft FTP Service 7.0 and 7.5 as shipped with IIS 7.0 and 7.5. A remote attacker can trigger it with a crafted FTP command, leading to arbitrary code execution or a daemon crash. The flaw is remotely reachable and requires no authentication.
Impact
An attacker can execute arbitrary code in the context of the FTP service or crash the daemon, giving full control of the affected host or causing a denial of service.
Attack surface
Reached over the network through the FTP service (AV:N, AC:L, Au:N per the CVSS vector), so no authentication or user interaction is required. Any host exposing the vulnerable IIS FTP service is directly reachable.
Exploitation
Public exploit code is referenced (Exploit-DB 15803, SecurityFocus BID 45542) and EPSS is very high at 0.945 (99.8th percentile), though the CVE is not listed in CISA KEV.
What to do
- Apply Microsoft security bulletin MS11-004 to patch ftpsvc.dll.
- If patching is not immediately possible, disable or stop the IIS FTP service on affected hosts.
- Restrict FTP access to trusted networks and block port 21 from untrusted sources at the perimeter.
- Replace FTP with SFTP/FTPS where feasible to reduce exposure of the legacy service.
- Monitor vendor guidance and re-check for updated fixes given the age of the affected IIS versions.
Detection
- Inspect FTP service logs for malformed or unusually long FTP commands preceding a service crash.
- Monitor for unexpected ftpsvc.dll process crashes or IIS FTP service restarts.
- Alert on FTP connections from untrusted external IP addresses to port 21.
- Correlate FTP session activity with post-exploitation process creation on the IIS host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-3972 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-3972), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
