{"api_version":"1","generated_at":"2026-07-23T04:05:46+00:00","cve":"CVE-2008-4572","urls":{"html":"https://cve.report/CVE-2008-4572","api":"https://cve.report/api/cve/CVE-2008-4572.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-4572","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-4572"},"summary":{"title":"CVE-2008-4572","description":"GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the CWD and LIST commands, which triggers heap corruption related to an improper free call, and possibly triggering a heap-based buffer overflow.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-10-15 20:00:03","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"10","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"https://www.exploit-db.com/exploits/6738","name":"https://www.exploit-db.com/exploits/6738","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"GuildFTPd 0.999.8.11/0.999.14 Heap Corruption PoC/DoS Exploit","mime":"text/x-python","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/31729","name":"http://www.securityfocus.com/bid/31729","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Malformed Request","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/32218","name":"http://secunia.com/advisories/32218","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"GuildFTPd \"LIST\" Processing Buffer Overflow Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45818","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45818","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/2794","name":"http://www.vupen.com/english/advisories/2008/2794","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/4422","name":"http://securityreason.com/securityalert/4422","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CXSecurity - IDS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4572","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4572","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"4572","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"guildftpd","cpe5":"guildftpd","cpe6":"0.999.14","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T10:24:21.124Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"31729","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/31729"},{"name":"32218","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/32218"},{"name":"ADV-2008-2794","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/2794"},{"name":"6738","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/6738"},{"name":"guildftpd-list-bo(45818)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45818"},{"name":"4422","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/4422"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-10-12T00:00:00.000Z","descriptions":[{"lang":"en","value":"GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the CWD and LIST commands, which triggers heap corruption related to an improper free call, and possibly triggering a heap-based buffer overflow."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"31729","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/31729"},{"name":"32218","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/32218"},{"name":"ADV-2008-2794","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/2794"},{"name":"6738","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/6738"},{"name":"guildftpd-list-bo(45818)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45818"},{"name":"4422","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/4422"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-4572","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the CWD and LIST commands, which triggers heap corruption related to an improper free call, and possibly triggering a heap-based buffer overflow."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"31729","refsource":"BID","url":"http://www.securityfocus.com/bid/31729"},{"name":"32218","refsource":"SECUNIA","url":"http://secunia.com/advisories/32218"},{"name":"ADV-2008-2794","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/2794"},{"name":"6738","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/6738"},{"name":"guildftpd-list-bo(45818)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45818"},{"name":"4422","refsource":"SREASON","url":"http://securityreason.com/securityalert/4422"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-4572","datePublished":"2008-10-15T18:12:00.000Z","dateReserved":"2008-10-15T00:00:00.000Z","dateUpdated":"2024-08-07T10:24:21.124Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-10-15 20:00:03","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:guildftpd:guildftpd:0.999.14:*:*:*:*:*:*:*","matchCriteriaId":"2631884D-371C-4B7F-ADD0-149B491C6DA1"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"4572","Ordinal":"1","Title":"CVE-2008-4572","CVE":"CVE-2008-4572","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"4572","Ordinal":"1","NoteData":"GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long arguments to the CWD and LIST commands, which triggers heap corruption related to an improper free call, and possibly triggering a heap-based buffer overflow.","Type":"Description","Title":"CVE-2008-4572"},{"CveYear":"2008","CveId":"4572","Ordinal":"2","NoteData":"2008-10-15","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"4572","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}