FTPShell server '.key' File Buffer Overflow Vulnerability
BID:33403
Info
FTPShell server '.key' File Buffer Overflow Vulnerability
| Bugtraq ID: | 33403 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-0349 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 22 2009 12:00AM |
| Updated: | Feb 11 2009 10:48PM |
| Credit: | Gjoko 'LiquidWorm' Krstic |
| Vulnerable: |
Codeorigin FTPShell Server 4.3 |
| Not Vulnerable: | |
Discussion
FTPShell server '.key' File Buffer Overflow Vulnerability
FTPShell Server is prone to a stack-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker could exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
FTPShell Server 4.3 is vulnerable; other versions may also be affected.
FTPShell Server is prone to a stack-based buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker could exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
FTPShell Server 4.3 is vulnerable; other versions may also be affected.
Exploit / POC
FTPShell server '.key' File Buffer Overflow Vulnerability
The following proof of concept is available:
The following proof of concept is available:
Solution / Fix
FTPShell server '.key' File Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
FTPShell server '.key' File Buffer Overflow Vulnerability
References:
References:
- FTPShell Homepage (Codeorigin)