KMINT21 Golden FTP Server Buffer Overflow Vulnerability (VU#620862)

Critical Vulnerability Information Vulnerability Overview Vulnerability ID: VU#620862 Original Release Date: 2005-02-25 Last Revised Date: 2005-02-25 Vulnerability Description Summary: Golden FTP server contains a buffer overflow vulnerability that may allow remote attackers to execute arbitrary code. Detailed Description: Golden FTP server is a personal FTP server for Microsoft Windows platforms. The RNTO (rename to) command is used in conjunction with the RNFR (rename from) command to rename files on the server. Specifically, RNFR specifies the current name of the file, while RNTO specifies the new name. If a remote, unauthenticated attacker sends a specially crafted rename request (RNFR and RNTO) to a vulnerable Golden FTP server, they may trigger a buffer overflow vulnerability in the routine that processes the RNTO command. Publicly Available Exploit: Available publicly. Impact Remote, unauthenticated attackers may be able to execute arbitrary code with the privileges of the Golden FTP server. Solution Upgrade: According to the developer of Golden FTP server, this issue has been fixed in Golden FTP server version 2.05b. Vendor Information Status: Affected Vendor: KMINT21 Software CVSS Rating Base Group: Insufficient Information References Secunia Advisory: http://secunia.com/advisories/13966/ OSVDB: http://www.osvdb.org/displayvuln.php?osvdb_id=13139 Acknowledgments Thanks to barabas mutsonline for reporting this vulnerability. Additional Information CVE ID: None Severity Metric: 17.25 Public Disclosure Date: 2005-01-22 Initial Release Date: 2005-02-25 Last Updated Date: 2005-02-25 16:49 UTC Document Revision Version: 60

Goal Reached Thanks to every supporter — we hit 100%!

KMINT21 Golden FTP Server Buffer Overflow Vulnerability (VU#620862)