FlashFXP Client Request Hostname Buffer Overflow Vulnerability

Bugtraq ID:	7859
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2003 12:00AM
Updated:	Jun 09 2003 12:00AM
Credit:	Discovery of this issue is credited to ":: Operash ::" <[email protected]>.
Vulnerable:	FlashFXP FlashFXP 2.0 build 905 FlashFXP FlashFXP 2.0
Not Vulnerable:	FlashFXP FlashFXP 2.1 build 924 FlashFXP FlashFXP 2.1 build 923

FlashFXP Client Request Hostname Buffer Overflow Vulnerability

FlashFXP is prone to a buffer overflow vulnerability. This is due to insufficient bounds checking of hostnames supplied in client requests. Exploitation would require a client user to submit a malicious request for an FTP site. This could permit execution of malicious instructions on the client system.

FlashFXP Client Request Hostname Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FlashFXP Client Request Hostname Buffer Overflow Vulnerability

Solution:
This issue has been addressed in FlashFXP version 2.1 build 923 and later.


FlashFXP FlashFXP 2.0

• FlashFXP FlashFXP 2.1 build 924
  http://www.flashfxp.com/download.php

FlashFXP FlashFXP 2.0 build 905

• FlashFXP FlashFXP 2.1 build 924
  http://www.flashfxp.com/download.php

FlashFXP Client Request Hostname Buffer Overflow Vulnerability

References:

• FlashFXP Homepage (FlashFXP)
  
• [FlashFXP] Two Buffer Overflow Vulnerabilities (":: Operash ::" )