Check Point Advisories

Preemptive Protection against WinFTP Server WFTPSRV.exe LIST FTP Command Buffer Overflow

Check Point Reference:	CPAI-2009-033
Date Published:	28 Jan 2009
Severity:	Medium
Last Updated:	Monday 09 February, 2009
Source:	Secunia: SA32209
Protection Provided by:
Who is Vulnerable?	Win FTP Win FTP Server 2.3 and earlier
Vulnerability Description	A buffer overflow vulnerability was reported in WinFTP Server, a popular Windows FTP Server. The vulnerability is due to insufficient bounds checking on certain FTP service commands. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted FTP LIST service command to the target server, potentially causing arbitrary code injection and execution with the privileges of the affected process.
Vulnerability Details	The vulnerability is due to a boundary error in "WFTPSRV.exe" when handling a malformed "LIST" command. Remote attackers could exploit this vulnerability by supplying an excessively long "LIST" command to a vulnerable installation of WinFTP. Successful exploitation would cause a buffer overflow that could allow the attacker to execute arbitrary code with the privileges of the logged-in user.