AmmSoft ScriptFTP 'GETLIST' or 'GETFILE' Commands Remote Buffer Overflow Vulnerability

Bugtraq ID:	49707
Class:	Boundary Condition Error
CVE:	CVE-2011-3976 CVE-2011-3976
Remote:	Yes
Local:	No
Published:	Sep 20 2011 12:00AM
Updated:	Oct 10 2011 11:40AM
Credit:	Tom Gregory
Vulnerable:	AmmSoft ScriptFTP 3.3
Not Vulnerable:

AmmSoft ScriptFTP 'GETLIST' or 'GETFILE' Commands Remote Buffer Overflow Vulnerability

ScriptFTP is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code within the context of the application. Failed attacks may cause a denial-of-service condition.

ScriptFTP 3.3 is vulnerable; other versions may also be affected.

AmmSoft ScriptFTP 'GETLIST' or 'GETFILE' Commands Remote Buffer Overflow Vulnerability

The following exploits are available:

• /data/vulnerabilities/exploits/49707.py
• /data/vulnerabilities/exploits/49707.rb
• /data/vulnerabilities/exploits/49707-2.rb

AmmSoft ScriptFTP 'GETLIST' or 'GETFILE' Commands Remote Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].

AmmSoft ScriptFTP 'GETLIST' or 'GETFILE' Commands Remote Buffer Overflow Vulnerability

References:

• ScriptFTP Homepage (AmmSoft)
  
• ScriptFTP 3.3 Remote Buffer Overflow Exploit (0day) (Digital Echidna)
  
• Vulnerability Note VU#440219 AmmSoft ScriptFTP 3.3 client remote buffer overflow (Tom Gregory)