WS_FTP Pro Client Remote Stack Buffer Overflow Vulnerability
BID:9886
Info
WS_FTP Pro Client Remote Stack Buffer Overflow Vulnerability
| Bugtraq ID: | 9886 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 16 2004 12:00AM |
| Updated: | Mar 16 2004 12:00AM |
| Credit: | Discovery is credited to nesumin <[email protected]>. |
| Vulnerable: |
Ipswitch WS_FTP Pro 8.0 3 |
| Not Vulnerable: | |
Discussion
WS_FTP Pro Client Remote Stack Buffer Overflow Vulnerability
It has been reported that WS_FTP Pro client may be prone to a remote buffer overflow vulnerability that may allow an attacker to execute arbitrary code on a vulnerable system in order to gain unauthorized access. The issue is reported to present itself when the client views directory listings containing files and directory names of excessive length without a terminating CR/LF character. This vulnerability exists in WS_FTP Pro version 8.0.3, which was released to fix the WS_FTP Pro Client Remote Buffer Overflow Vulnerability described in BID 9872. It has been reported that the fixed version limits user-supplied data to 0x0200 bytes; however, the buffer is allocated to 0x0100 bytes.
Although this issue is reported to affect WS_FTP Pro 8.0.3, it is quite likely that it affects previous versions as well.
It has been reported that WS_FTP Pro client may be prone to a remote buffer overflow vulnerability that may allow an attacker to execute arbitrary code on a vulnerable system in order to gain unauthorized access. The issue is reported to present itself when the client views directory listings containing files and directory names of excessive length without a terminating CR/LF character. This vulnerability exists in WS_FTP Pro version 8.0.3, which was released to fix the WS_FTP Pro Client Remote Buffer Overflow Vulnerability described in BID 9872. It has been reported that the fixed version limits user-supplied data to 0x0200 bytes; however, the buffer is allocated to 0x0100 bytes.
Although this issue is reported to affect WS_FTP Pro 8.0.3, it is quite likely that it affects previous versions as well.
Exploit / POC
WS_FTP Pro Client Remote Stack Buffer Overflow Vulnerability
The discoverer of this vulnerability has developed an exploit, however, it has not been released to the public.
The discoverer of this vulnerability has developed an exploit, however, it has not been released to the public.
Solution / Fix
WS_FTP Pro Client Remote Stack Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
WS_FTP Pro Client Remote Stack Buffer Overflow Vulnerability
References:
References:
- Ipswitch Homepage (Ipswitch)
- Re: ws_ftp overflow ([email protected])