Odin Secure FTP versions up to 4.1 are vulnerable to a stack-based buffer overflow when processing directory listings from an FTP LIST command. A malicious FTP server can exploit this vulnerability by sending an excessively long filename, which can overwrite the Structured Exception Handler (SEH) in the client. This flaw allows remote attackers to execute arbitrary code on the affected client system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2010-10014 |
Exploitation
To exploit this vulnerability, an attacker must set up a malicious FTP server that sends a specially crafted directory listing containing an overly long filename. When the affected client processes this response, it will trigger the stack-based buffer overflow, allowing the attacker to execute arbitrary code on the client system.
Affected Products
- Odin Secure FTP version 4.1 and earlier: This version is directly affected by the buffer overflow vulnerability when handling FTP LIST command responses.
Mitigation
To mitigate this vulnerability, users should upgrade to a patched version of Odin Secure FTP that addresses this buffer overflow issue. Additionally, users should avoid connecting to untrusted FTP servers and implement network security measures to limit exposure to potential attacks.