Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

CoffeeCup FTP Clients Buffer Overflow Vulnerability
From: Komrade <unsecure () altervista org>
Date: Mon, 22 Nov 2004 15:39:34 +0100

AUTHOR
Komrade
unsecure () altervista org
http://unsecure.altervista.org

DATE
22/11/2004

PRODUCTS
CoffeCup Direct FTP - FTP client for Windows.
CoffeeCup Free FTP - free FTP client for Windows.

AFFECTED VERSION
Versions verified to be vulnerable:
CoffeeCup Direct FTP 6.2.0.62 (latest version)
CoffeeCup Free FTP 3.0.0.10 (latest version)

Prior version should be vulnerable as well.

DETAILS
Each this programs use the ActiveX Control "WeOnlyDo! COM Ftp DELUXE"
(WodFtpDLX.ocx) to communicate with FTP servers.
I discovered that this ActiveX doesn't correctly handle a very long file
name sent from an FTP server, causing the programs to be vulnerable to a
remote buffer overflow.

Details on the vulnerabiliy that affect WodFtpDLX ActiveX Control can be
found here:
http://unsecure.altervista.org/security/wodftpdlx.htm

POC EXPLOIT
You can find a proof of concept exploit that spawn a shell on port 5555
on the target machine here:
http://unsecure.altervista.org/security/coffeecupbof.c

VENDOR STATUS
I notified this vulnerability to the vendor on 19/11/2004 and they
replied that they would start immediately to work on a fix.

VULNERABILITY TIMELINE
16/11/2004 Vulnerbility found.
19/11/2004 Vendor contacted for the first time.
19/11/2004 Vendor reply. They are working to fix this vulnerability.
22/11/2004 Public disclosure.


--
- Unsecure Programs -
- http://unsecure.altervista.org -

- Vulnerabilities and exploits -
- http://unsecure.altervista.org/security.htm -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
  • CoffeeCup FTP Clients Buffer Overflow Vulnerability Komrade (Nov 22)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]