ArGoSoft FTP Server RNTO Command Remote Buffer Overflow Vulnerability

Bugtraq ID:	17789
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	May 02 2006 12:00AM
Updated:	May 08 2006 10:34PM
Credit:	Discovery is credited to Leon Juranic <[email protected]>.
Vulnerable:	ArGo Software Design FTP Server 1.4.3 .6
Not Vulnerable:

ArGoSoft FTP Server RNTO Command Remote Buffer Overflow Vulnerability

ArGoSoft FTP Server is prone to a buffer-overflow vulnerability when handling data through the RNTO command.

Reportedly, passing excessive data in the Unicode format may overflow a finite-sized internal memory buffer. A successful attack may result in memory corruption as memory adjacent to the buffer is overwritten with user-supplied data.

This issue may lead to a denial-of-service condition or the execution of arbitrary code.

Version 1.4.3.6 of ArGoSoft FTP Server is vulnerable to this issue; other versions may also be affected.

ArGoSoft FTP Server RNTO Command Remote Buffer Overflow Vulnerability

This issue can be triggered by using the Infigo FTPStress Fuzzer.

ArGoSoft FTP Server RNTO Command Remote Buffer Overflow Vulnerability

Solution:

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]

ArGoSoft FTP Server RNTO Command Remote Buffer Overflow Vulnerability

References:

• Infigo FTPStress Fuzzer (Infigo)
  
• ArGoSoft FTP Server Product Home Page (ArGoSoft)
  
• INFIGO-2006-05-03: Multiple FTP Servers vulnerabilities ("infocus" )