FileWrangler version 5.30 and earlier is vulnerable to a stack-based buffer overflow when processing directory listings from an FTP server. A malicious server can exploit this by sending an excessively long folder name in response to a LIST command, leading to memory corruption during client-side rendering. This vulnerability requires passive user interaction, as simply connecting to the server is sufficient for exploitation, potentially resulting in arbitrary code execution.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.5 | CVE-2010-20045 |
Exploitation
To exploit this vulnerability, an attacker must set up a malicious FTP server that responds to LIST commands with an overly long folder name. When a user connects to this server using FileWrangler, the application will attempt to render the directory listing, leading to a stack-based buffer overflow and potentially allowing the attacker to execute arbitrary code on the victim’s machine.
Affected Products
- FileWrangler 5.30 and earlier: This version is susceptible to the stack-based buffer overflow vulnerability when interacting with malicious FTP servers.
Mitigation
To mitigate this vulnerability, users should upgrade to a patched version of FileWrangler that addresses the buffer overflow issue. Additionally, users should avoid connecting to untrusted FTP servers and consider using alternative FTP clients that have stronger security measures in place.