[NT] Buffer Overflow in LeapFTP (Long HOST in lsq)

From: SecuriTeam (support_at_securiteam.com)
Date: 08/28/05

  • Next message: SecuriTeam: "[NT] Home Ftp Server Multiple Vulnerabilities (Information Disclosure, Directory Traversal)" 
    To: list@securiteam.com
Date: 28 Aug 2005 11:06:09 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Buffer Overflow in LeapFTP (Long HOST in lsq)
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.leapware.com/> LeapFTP is the award-winning shareware FTP
    client that combines an intuitive interface with one of the most powerful
    client bases around.
    By sending the malformed .lsq file to the victim, after the victim open
    the .lsq file, arbitray code may executed.

    DETAILS

    Vulnerable Systems:
     * LeapFTP versions lower than 2.7.6.612

    LSQ is the LeapFTP Site Queue file, And it is registered with Windows by
    LeapFTP. You can save a transfer Queue to .lsq files and transfer it later
    by opening the .lsq files.
    However, LeapFTP does not properly check the length of the "Host" fields,
    when a overly long string is supplied, there will be a buffer overflow and
    probably arbitrary code execution.

    Proof of Concept Code:
    //bof.lsq

    [HOSTINFO]
    HOST=AAAAA...[ long string ]...AAAAA
    USER=username
    PASS=password

    [FILES]
    "1","/winis/ApiList.zip","477,839","E:\ApiList.zip"

    Solution:
    All users are encouraged to upgrade to 2.7.6 immediately
    Vendor also released an advisory at:
    <http://www.leapware.com/security/2005082301.txt>
    http://www.leapware.com/security/2005082301.txt

    Vendor Status:
    2005.08.22 Vendor notified via online WebForm
    2005.08.23 Vendor responsed and bug fixed
    2005.08.24 Vendor released the new version 2.7.6.612
    2005.08.24 Advisory Released

    ADDITIONAL INFORMATION

    The information has been provided by Sowhat.
    The original article can be found at:
    <http://secway.org/advisory/AD20050824.txt>
    http://secway.org/advisory/AD20050824.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Home Ftp Server Multiple Vulnerabilities (Information Disclosure, Directory Traversal)"

    Relevant Pages