CVE-2023-3603

Summary

CVE-2023-3603 is a vulnerability affecting sftp servers due to a missing allocation check during read requests. Under low-memory conditions, this issue can lead to a NULL dereference. Malicious clients can exploit this by requesting large SFTP reads, causing the allocation of up to 4GB buffers. This can result in the crashing of the user's sftp server connection for forking implementations. For thread-based servers, this could also cause Denial of Service (DoS) attacks against legitimate users. However, as this code has not been released in any versions, no security updates have been issued yet.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.