CuteFTP 6.0 Professional Remote Buffer Overflow Vulnerability

Type securityvulns
Reporter Securityvulns
Modified 2004-11-30T00:00:00


Author: Hongzhen Zhou(Fortinet, Inc) <felix__zhou at hotmail dot com>

DATE: 24/11/2004

PRODUCTS: CuteFTP Professional - FTP client for Windows.

AFFECTED VERSION: Versions verified to be vulnerable: CuteFTP Professional 6.0 (latest verson) Other versions are not tested.

DETAILS: When CuteFTP Professional process replies to many commands from a malicious FTP server, if the reply code is big than 500(4xx works sometimes) and the length of text following is big than 65530, the Cute FTP Professional will crash. Only some command's replies are not affected(like USER, PASS). It becomes even worse when the CuteFTP connects to server to wait for the welcome message reply, the malicious server could send such a reply to crash it.

We are not sure if this bug could be exploited to let the attacker execute arbitrary code remotely.