CyberRota Analysis
AI-GeneratedThe vulnerability affects the FTP analyzer in Zeek versions prior to 8.0.9, allowing unauthenticated remote attackers to exploit an unchecked memory consumption issue. By sending a specially crafted FTP control session that includes a large ADAT control line, attackers can trigger unbounded buffer growth, leading to denial of service and potential termination of the Zeek sensor process. Organizations using Zeek for network monitoring and security should prioritize applying the update to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit the NVT_Analyzer component's lack of a maximum line length check, causing it to continuously double its internal buffer without bounds during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor.
Related CVEs
Other vulnerabilities affecting the same vendor(s)