Crystal Art Crystal FTP Remote Client-Side Buffer Overflow Vulnerability

Bugtraq ID:	12038
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 20 2004 12:00AM
Updated:	Dec 20 2004 12:00AM
Credit:	Luca Ercoli <[email protected]> is credited with the discovery of this issue.
Vulnerable:	Crystal Art Software Crystal FTP 2.8 Crystal Art Software Crystal FTP 2.7 Crystal Art Software Crystal FTP 2.6 Crystal Art Software Crystal FTP 2.5 Crystal Art Software Crystal FTP 2.4
Not Vulnerable:

Crystal Art Crystal FTP Remote Client-Side Buffer Overflow Vulnerability

A remote, client-side buffer overflow vulnerability reportedly affects Crystal Art Crystal FTP. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

Crystal Art Crystal FTP Remote Client-Side Buffer Overflow Vulnerability

The following exploit has been provided by <[email protected]>:

• /data/vulnerabilities/exploits/crystal_expl.c

Crystal Art Crystal FTP Remote Client-Side Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Crystal Art Crystal FTP Remote Client-Side Buffer Overflow Vulnerability

References:

• Crystal FTP Home Page (Crystal Art Software)
  
• Crystal FTP Pro Client Buffer Overflow (Luca Ercoli )
  
• RE: Crystal FTP Pro 2.8 PoC ()