LeapFTP versions below 3.1.x contain a stack-based buffer overflow vulnerability in its FTP client parser. This vulnerability occurs when the client receives a directory listing with a filename longer than 528 bytes, leading to improper input bound-checking. An attacker can exploit this flaw by operating a malicious FTP server, allowing them to execute arbitrary code on the victim’s machine when the file is listed or downloaded.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2010-20049 |
Exploitation
To exploit this vulnerability, an attacker must set up a malicious FTP server that sends a directory listing containing a filename longer than 528 bytes. When the vulnerable LeapFTP client connects to this server and processes the directory listing, it will overwrite the Structured Exception Handler (SEH) chain, allowing the attacker to execute arbitrary code on the victim’s machine.
Affected Products
- LeapFTP < 3.1.x: The FTP client is vulnerable to stack-based buffer overflow due to improper handling of long filenames in directory listings.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of LeapFTP that addresses this issue. Additionally, users should avoid connecting to untrusted FTP servers and implement network security measures to limit exposure to potential attacks.