Quick 'n Easy FTP Server USER Command Remote Buffer Overflow Vulnerability

Bugtraq ID:	42186
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 22 2010 12:00AM
Updated:	Jul 22 2010 12:00AM
Credit:	demonalex
Vulnerable:	Pablo Software Solutions Quick And Easy FTP Server 3.9.1
Not Vulnerable:

Quick 'n Easy FTP Server USER Command Remote Buffer Overflow Vulnerability

Quick 'n Easy FTP Server is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Quick 'n Easy FTP Server 3.9.1 is vulnerable; other versions may also be affected.

Quick 'n Easy FTP Server USER Command Remote Buffer Overflow Vulnerability

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/42186.pl

Quick 'n Easy FTP Server USER Command Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Quick 'n Easy FTP Server USER Command Remote Buffer Overflow Vulnerability

References:

• Quick 'n Easy FTP Server Homepage (Pablo Software Solutions)
  
• Quick Easy FTP Server USER command Vulnerability ([email protected])