vxFtpSrv CWD Command Buffer Overflow Vulnerability
BID:31532
Info
vxFtpSrv CWD Command Buffer Overflow Vulnerability
| Bugtraq ID: | 31532 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-4452 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 02 2008 12:00AM |
| Updated: | Apr 16 2015 05:53PM |
| Credit: | Julien Bedard |
| Vulnerable: |
Cambridge Computer Corporation vxFtpSrv 2.0.3 |
| Not Vulnerable: | |
Discussion
vxFtpSrv CWD Command Buffer Overflow Vulnerability
vxFtpSrv is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
vxFtpSrv 2.0.3 is vulnerable; other versions may also be affected.
vxFtpSrv is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
vxFtpSrv 2.0.3 is vulnerable; other versions may also be affected.
Exploit / POC
vxFtpSrv CWD Command Buffer Overflow Vulnerability
The following proof-of-concept exploit is available:
The following proof-of-concept exploit is available:
Solution / Fix
vxFtpSrv CWD Command Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
vxFtpSrv CWD Command Buffer Overflow Vulnerability
References:
References:
- vxFtpSrv Homepage (Cambridge Computer Corporation)