FlashFXP PASV Response Buffer Overflow Vulnerability

Bugtraq ID:	7857
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2003 12:00AM
Updated:	Jun 09 2003 12:00AM
Credit:	Discovery of this issue is credited to ":: Operash ::" <[email protected]>.
Vulnerable:	FlashFXP FlashFXP 2.0 build 905 FlashFXP FlashFXP 2.0
Not Vulnerable:	FlashFXP FlashFXP 2.1 build 924 FlashFXP FlashFXP 2.1 build 923

FlashFXP PASV Response Buffer Overflow Vulnerability

FlashFXP is prone to a remotely exploitable buffer overflow when handling a server response to the PASV FTP command. A malicious FTP server could exploit this issue to execute code on the client system.

FlashFXP PASV Response Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FlashFXP PASV Response Buffer Overflow Vulnerability

Solution:
This issue has been addressed in FlashFXP version 2.1 build 923 and later.


FlashFXP FlashFXP 2.0

• FlashFXP FlashFXP 2.1 build 924
  http://www.flashfxp.com/download.php

FlashFXP FlashFXP 2.0 build 905

• FlashFXP FlashFXP 2.1 build 924
  http://www.flashfxp.com/download.php

FlashFXP PASV Response Buffer Overflow Vulnerability

References:

• FlashFXP Homepage (FlashFXP)
  
• [FlashFXP] Two Buffer Overflow Vulnerabilities (":: Operash ::" )