Fetch Softworks Fetch FTP Client 5.8 Remote DoS Vulnerability (ZSL-2022-5696)

Vulnerability Key Information Title Fetch Softworks Fetch FTP Client 5.8 Remote CPU Consumption (Denial of Service) Advisory ID ZSL-2022-5696 Type Local/Remote Impact DoS Risk 2/5 Release Date 27.01.2022 Summary The application is vulnerable to a DoS attack when receiving a server response longer than 2K bytes, resulting in 100% CPU consumption. Description Fetch is a reliable and feature-rich file transfer client for Apple Macintosh, with a user interface emphasizing simplicity and ease of use. Fetch supports FTP and SFTP, the most popular file transfer protocols on the Internet, and is compatible with thousands of Internet service providers, web hosting companies, publishers, prepress companies, and more. Vendor Fetch Softworks - https://www.fetchsoftworks.com Affected Versions 5.8.2 (5K1354) Tested On macOS Monterey 12.2 macOS Big Sur 11.6.2 Vendor Status N/A Proof of Concept fetchftp_cpu.py Acknowledgements Vulnerability discovered by Gjoko Krstic - References [1] https://packetstormsecurity.com/files/165769/ [2] https://cxsecurity.com/issue/WLB-2022010141 [3] https://exchange.xforce.ibmcloud.com/vulnerabilities/218386 [4] https://www.exploit-db.com/exploits/50696 Change Log [27.01.2022] - Initial release [01.02.2022] - Added references [1], [2], and [3] [02.02.2022] - Added reference [4] Contact Zero Science Lab Web: https://www.zeroscience.mk e-mail: lab@zeroscience.mk

Goal Reached Thanks to every supporter — we hit 100%!

Fetch Softworks Fetch FTP Client 5.8 Remote DoS Vulnerability (ZSL-2022-5696)