wodFtpDLX long filename buffer overflow
| wodftpdlx-long-filename-bo (18190) |  High Risk |
Description:
wodFtpDLX is vulnerable to a buffer overflow, caused by improper handling of long file names in the WodFtpDLX ActiveX Control. By sending a long file name to wodftpdlx using the strncpy function, a remote attacker could overwrite the Structured Exception Handling (SEH) address and execute arbitrary code on the system.
Note: CoffeeCup Direct FTP version 6.2.0.62 and CoffeeCup Free FTP version 3.0.0.10 are also affected by this vulnerability.
Platforms Affected:
- CoffeeCup, CoffeeCup Direct FTP 6.2.0.62
- CoffeeCup, CoffeeCup Free FTP 3.0.0.10
- WeOnlyDo, wodFtpDLX prior to 2.3.2.97
Remedy:
Upgrade to the latest version of wodftpdlx (2.3.2.97 or later), available from the WeOnlyDo! Web site. See References.
Consequences:
Gain Access
References:
- Full-Disclosure Mailing List, Mon Nov 22 2004 - 08:37:57 CST, WeOnlyDo! COM Ftp DELUXE ActiveX Control Buffer Overflow Vulnerability at http://archives.neohapsis.com/archives/fulldisclosure/2004-11/0975.html.
- Full-Disclosure Mailing List, Mon Nov 22 2004 - 08:39:34 CST, CoffeeCup FTP Clients Buffer Overflow Vulnerability at http://archives.neohapsis.com/archives/fulldisclosure/2004-11/0974.html.
- WeOnlyDo! Web site, wodFtpDLX ActiveX component at http://www.weonlydo.com/index.asp?showform=FtpDLX.
- BID-11721: WeOnlyDo! wodFtpDLX ActiveX Component Remote Buffer Overflow Vulnerability
- CVE-2004-1118: Buffer overflow in the WodFtpDLX.ocx (WeOnlyDo!) ActiveX component before 2.3.2.97, as used by CoffeeCup Direct FTP 6.2.0.62 and CoffeeCup Free FTP 3.0.0.10, and possibly other applications, allows remote attackers to execute arbitrary code via a long filename.
Reported:
Nov 22, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net