WeOnlyDo! wodFtpDLX ActiveX Component Remote Buffer Overflow Vulnerability
BID:11721
Info
WeOnlyDo! wodFtpDLX ActiveX Component Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 11721 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Nov 22 2004 12:00AM |
| Updated: | Nov 22 2004 12:00AM |
| Credit: | Discovery of this issue is credited to Komrade <[email protected]>. |
| Vulnerable: |
WeOnlyDo! wodFtpDLX ActiveX component 2.1.1 8 WeOnlyDo! wodFtpDLX ActiveX component |
| Not Vulnerable: | |
Discussion
WeOnlyDo! wodFtpDLX ActiveX Component Remote Buffer Overflow Vulnerability
A remote buffer overflow vulnerability reportedly affects the WeOnlyDo! wodFtpDLX ActiveX Component. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into finite process buffers.
An attacker may exploit this issue to execute arbitrary code with the privileges of a user that started an application that implements the vulnerable ActiveX conmponent.
A remote buffer overflow vulnerability reportedly affects the WeOnlyDo! wodFtpDLX ActiveX Component. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into finite process buffers.
An attacker may exploit this issue to execute arbitrary code with the privileges of a user that started an application that implements the vulnerable ActiveX conmponent.
Exploit / POC
WeOnlyDo! wodFtpDLX ActiveX Component Remote Buffer Overflow Vulnerability
The following exploits have been made available. The first demonstrates this issue against the affective ActiveX component, and the second demonstrates this issue against the CoffeeCup Direct FTP client that implements the vulnerable component.
The following exploits have been made available. The first demonstrates this issue against the affective ActiveX component, and the second demonstrates this issue against the CoffeeCup Direct FTP client that implements the vulnerable component.
Solution / Fix
WeOnlyDo! wodFtpDLX ActiveX Component Remote Buffer Overflow Vulnerability
Solution:
It has been reported that a fixed version of the ActiveX component has been provided by the vendor resolving this issue. This is not verified; users should contact the vendor for more information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It has been reported that a fixed version of the ActiveX component has been provided by the vendor resolving this issue. This is not verified; users should contact the vendor for more information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
WeOnlyDo! wodFtpDLX ActiveX Component Remote Buffer Overflow Vulnerability
References:
References:
- CoffeeCup Direct FTP Home Page (CoffeeCup Software)
- wodFtpDLX ActiveX component Home Page (WeOnlyDo! Software)
- CoffeeCup FTP Clients Buffer Overflow Vulnerability (Komrade
- WeOnlyDo! COM Ftp DELUXE ActiveX Control Buffer Overflow Vulnerability (Komrade