Description
Off-by-one error in the do_login_loop function in libwzd-core/wzd_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other versions allows remote attackers to cause a denial of service (daemon crash) via a long USER command that triggers a stack-based buffer overflow. NOTE: some of these details are obtained from third party information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | wzdftpd | 0.8.1-2etch1 | DSA-1452-1 |
| Debian 3.1 | wzdftpd | 0.5.2-1.1sarge3 | DSA-1452-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- WzdFTPD 0.8.0 - 'USER' Remote Denial of Service EDB-4498 · dos · Oct 7, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-1452-1 wzdftpd denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- wzdftpd-user-dos(37010) vdb-entry
- 27091 third-party-advisory
- ADV-2007-3389 vdb-entry
- 25967 vdb-entry
- wzdftpd-dologinloop-bo(37008) vdb-entry
- 4498 exploit
- DSA-1452 vendor-advisory
- 28342 third-party-advisory