CVE-2003-0963

CVE-2003-0963 describes buffer overflow vulnerabilities in lftp versions 2.6.9 and earlier, specifically within the try_netscape_proxy and try_squid_eplf functions. These flaws allow remote HTTP servers to execute arbitrary code on affected systems by providing excessively long directory names that are then processed by the ls or rels commands. The vulnerability carries a CVSS score of 7.5, indicating high severity with a network attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit (EDB-143) for a remote stack overflow in lftp 2.6.9 exists, suggesting exploitability, though there is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage.