Researcher discloses Microsoft FTP client flaw

By

A just discovered vulnerability in Microsoft's FTP client can allow a malicious user to crash the application via a malware-laced social engineering attack.

Researcher discloses Microsoft FTP client flaw
Researcher Rajesh Sethumadhavan said Wednesday that the buffer overflow flaw, which he discovered on Nov. 20, can allow a DoS attack or the execution of arbitrary code on a victimized computer.

However, other researchers on Thursday downplayed the threat.

The vulnerability exists within the FTP Client application on Windows 2000 Server, Windows 2000 Professional and XP operating systems. Other versions may also be affected, according to the Bangalore, India-based researcher, who provided proof-of-concept code.

The flaw is caused by an error when the client validates commands such as “mget,” “dir,” “user” and “ils.” For exploitation, an attacker would have to craft a malicious payload with those commands, Sethumadhavan said.

“This vulnerability is hard to exploit since it requires social engineering and shellcode has to be injected as argument in vulnerable commands,” he said.

Ben Greenbaum, senior research manager at Symantec Security Response, said the flaw takes so much work to exploit that it should not be a concern for administrators.

“Exploitation of this issue would require a fair amount of social engineering, and it would require the user to take actions that are patently unsafe,” he said. “It would unfortunate, with all the other threats and vulnerabilities out there that need patching, if users or IT staffs spent too much time worrying about this one.”

A Microsoft representative could not be reached for comment today.

See original article on SC Magazine US
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Microsoft knew of SharePoint security flaw in May, initial patch ineffective

Microsoft knew of SharePoint security flaw in May, initial patch ineffective

Gov to encourage vuln research, puts insurers and NFPs on notice

Gov to encourage vuln research, puts insurers and NFPs on notice

Palo Alto Networks in talks to buy CyberArk

Palo Alto Networks in talks to buy CyberArk

Allianz Life says majority of US customers' data stolen in hack

Allianz Life says majority of US customers' data stolen in hack

Log In

  |  Forgot your password?