SapporoWorks Black JumboDog FTP Server Buffer Overflow Vulnerability
BID:10834
Info
SapporoWorks Black JumboDog FTP Server Buffer Overflow Vulnerability
| Bugtraq ID: | 10834 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 30 2004 12:00AM |
| Updated: | Jul 30 2004 12:00AM |
| Credit: | Tan Chew Keong of SIG^2 disclosed this vulnerability. |
| Vulnerable: |
SapporoWorks Black JumboDog 3.6.1 |
| Not Vulnerable: |
SapporoWorks Black JumboDog 3.6.2 |
Discussion
SapporoWorks Black JumboDog FTP Server Buffer Overflow Vulnerability
Black JumboDog is reported to contain a buffer overflow vulnerability in its FTP server. This issue results from insufficient boundary checks performed by the application when processing user-supplied data. This issue can be exploited before authenticating to the FTP server.
This issue may lead to arbitrary code execution if an attacker can direct program execution to attacker supplied memory locations containing malicious shellcode. The attacker may ultimately gain unauthorized access to a vulnerable computer in the context of the FTP server process.
Version 3.6.1 is reported vulnerable. Other prior versions may also be affected.
Black JumboDog is reported to contain a buffer overflow vulnerability in its FTP server. This issue results from insufficient boundary checks performed by the application when processing user-supplied data. This issue can be exploited before authenticating to the FTP server.
This issue may lead to arbitrary code execution if an attacker can direct program execution to attacker supplied memory locations containing malicious shellcode. The attacker may ultimately gain unauthorized access to a vulnerable computer in the context of the FTP server process.
Version 3.6.1 is reported vulnerable. Other prior versions may also be affected.
Exploit / POC
SapporoWorks Black JumboDog FTP Server Buffer Overflow Vulnerability
Exploit code is available.
Exploit code is available.
Solution / Fix
SapporoWorks Black JumboDog FTP Server Buffer Overflow Vulnerability
Solution:
The vendor has released version 3.6.2 of the application. This version is reported to contain a fix for this issue.
SapporoWorks Black JumboDog 3.6.1
Solution:
The vendor has released version 3.6.2 of the application. This version is reported to contain a fix for this issue.
SapporoWorks Black JumboDog 3.6.1
-
SapporoWorks bjd-patch-3.6.2.lzh
http://homepage2.nifty.com/spw/software/bjd/bin/bjd-patch-3.6.2.lzh -
SapporoWorks bjd-src-3.6.2.lzh
http://homepage2.nifty.com/spw/software/bjd/bin/bjd-src-3.6.2.lzh
References
SapporoWorks Black JumboDog FTP Server Buffer Overflow Vulnerability
References:
References:
- BlackJumboDog Homepage (SapporoWorks)
- Buffer overflow in SapporoWorks BlackJumboDog FTP server (SIG^2 Vulnerability Research)