CVE-2009-4593: Jesse Smith Bftpd

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

The bftpdutmp_log function in bftpdutmp.c in Bftpd before 2.4 does not place a '\0' character at the end of the string value of the ut.bu_host structure member, which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors. NOTE: some of these details are obtained from third party information.

Affected products

• Jesse Smith Bftpd: up to and including 2.3; version 1.6 only; version 1.7 only; version 1.7.2 only; version 1.8 only; version 2.0.2 only; …

Published 2010-01-07. Last modified 2026-06-16.