vendor:
Tiny FTPd
by:
UNYUN
7.5
CVSS
HIGH
Buffer Overflow
119
CWE
Product Name: Tiny FTPd
Affected Version From: 0.52 beta3 and possible previous versions
Affected Version To: 0.52 beta3 and possible previous versions
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested: Windows 98 with IE5
Unknown
Tiny FTPd 0.52 beta3 exploit
The exploit takes advantage of unchecked buffers in the code that handles certain commands in Tiny FTPd. By exploiting these overflows, an attacker can overwrite the stack and execute arbitrary code. This specific exploit uses the STOR overflow to create a registry key and entry that modifies IE's security settings. The exploit then starts IE and loads a webpage that triggers the execution of ActiveX code.
Mitigation:
Update to a patched version of Tiny FTPd or switch to a different FTP server software. Avoid running vulnerable versions on publicly accessible systems.
