DataWizard FtpXQ Buffer Overflow Vulnerability

Bugtraq ID:	4862
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	May 27 2002 12:00AM
Updated:	May 27 2002 12:00AM
Credit:	Discovery credited to "SnakeByte / Eric Sesterhenn" <[email protected]>.
Vulnerable:	DataWizard FtpXQ 2.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 SR2 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0
Not Vulnerable:

DataWizard FtpXQ Buffer Overflow Vulnerability

FtpXQ is vulnerable to a buffer overflow which may result in a denial of service condition. Creating an exceptionally long directory name will cause the server to crash. It is also believed that attackers can cause arbirtary code to be executed on target servers, however this is not confirmed.

DataWizard FtpXQ Buffer Overflow Vulnerability

There is no exploit required for this vulnerability.

DataWizard FtpXQ Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

DataWizard FtpXQ Buffer Overflow Vulnerability

References:

• DataWizard Homepage (DataWizard)