TurboFTP Server 'PORT' Command Processing Stack Based Buffer Overflow Vulnerability
28 Oct. 2012
Summary
TurboFTP Server is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Credit:
The information has been provided by Zhao Liang.
An attacker can exploit this issue to execute arbitrary code in the context of the affected server. Successful attacks will compromise the server and possibly the underlying computer. Failed attacks will likely cause denial-of-service conditions. Zhao Liang has discovered a vulnerability in TurboFTP Server, which can be exploited by malicious users to compromise a vulnerable system.
The vulnerability is caused due to a boundary error when processing the FTP "PORT" command. This can be exploited to cause a stack-based buffer overflow via an overly long IP octet string.
Successful exploitation allows execution of arbitrary code.
Disclosure Timeline:
Published: Oct 03 2012 12:00AM
Updated: Oct 22 2012 06:30AM
