[NT] CuteFTP Buffer Overflow in LIST's Response

From: support@securiteam.com
Date: 01/23/03

  • Next message: support@securiteam.com: "[UNIX] ftls.org Guestbook Script Injection Vulnerabilities" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 23 Jan 2003 18:12:06 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      CuteFTP Buffer Overflow in LIST's Response
    ------------------------------------------------------------------------

    SUMMARY

    When a FTP Server is responding to a "LIST" (directory listing) command,
    the response is sent over a data connection. Sending 257 bytes over this
    connection will cause a buffer to overflow, and the EIP register can be
    overwritten completely by sending 260 bytes of data.

    DETAILS

    Vulnerable systems:
     * CuteFTP 5.0 XP build 50.6.10.2

    Impact:
    This could allow arbitrary code to be executed on the remote victim's
    machine, if the attacker is successful in luring a victim onto his server.

    Vendor Status:
    Contacted GlobalSCAPE Jan 14th 2003, After a couple of emails back and
    forth within a few days, they confirmed the problem, and said they are
    working on a release for Monday (20th Jan, 03) which will address the
    issue.

    Solution:
    Upgrade to new version which should be available from Monday (20th Jan,
    03).

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:fitzies@hotmail.com> Lance
    Fitz-Herbert.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages