|
Brought to you by:
Suppliers of:
|
|
|
| |
| When a FTP Server is responding to a "LIST" (directory listing) command, the response is sent over a data connection. Sending 257 bytes over this connection will cause a buffer to overflow, and the EIP register can be overwritten completely by sending 260 bytes of data. |
| |
Credit:
The information has been provided by Lance Fitz-Herbert.
|
| |
Vulnerable systems:
* CuteFTP 5.0 XP build 50.6.10.2
Impact:
This could allow arbitrary code to be executed on the remote victim's machine, if the attacker is successful in luring a victim onto his server.
Vendor Status:
Contacted GlobalSCAPE Jan 14th 2003, After a couple of emails back and forth within a few days, they confirmed the problem, and said they are working on a release for Monday (20th Jan, 03) which will address the issue.
Solution:
Upgrade to new version which should be available from Monday (20th Jan, 03).
|
|
|
|
|
