Tango FTP ActiveX Control Remote Heap Buffer Overflow Vulnerability

Bugtraq ID:	75319
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 19 2015 12:00AM
Updated:	Jun 19 2015 12:00AM
Credit:	metacom
Vulnerable:	Tango FTP Tango FTP 1.0 build 136
Not Vulnerable:

Tango FTP ActiveX Control Remote Heap Buffer Overflow Vulnerability

Tango FTP is prone to a remote heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code in the context of an application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions.

Tango FTP ActiveX Control Remote Heap Buffer Overflow Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/75319.html.txt

Tango FTP ActiveX Control Remote Heap Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Tango FTP ActiveX Control Remote Heap Buffer Overflow Vulnerability

References:

• Tango FTP Homepage (Tango FTP)