Secunia Research has discovered some vulnerabilities in Free Download Manager, which can be exploited by malicious people to compromise a user's system.

1) A boundary error in the parsing of file names inside torrent files can be exploited to cause a heap-based buffer overflow by e.g. tricking a user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other versions may also be affected.

2) Two boundary errors when parsing names from torrent files can be exploited to cause stack-based buffer overflows by e.g. tricking a user into opening a specially crafted torrent file.

The vulnerabilities are confirmed in versions 2.5 Build 758 and 3.0 Build 844. Other versions may also be affected.

3) A boundary error in the Remote Control Server when processing "Authorization" headers in HTTP requests can be exploited to cause a stack-based buffer overflow via an HTTP request containing an overly long "Authorization" header.

The vulnerability is confirmed in versions 2.5 Build 758 and 3.0 Build 844. Other versions may also be affected.

NOTE: The vendor states that the remote control service can be used to connect remotely to the system over the Internet. However, since basic authorization is used for transmitting credentials, users should be aware that anyone able to intercept the traffic can gain knowledge of the username and password.

4) A boundary error when parsing tracker URLs from torrent files can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other versions may also be affected.

5) A boundary error when parsing comments from torrent files can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other versions may also be affected.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

Solution
Update to version 3.0 build 848.

Provided and/or discovered by
Carsten Eiram, Secunia Research.

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2009-3/
http://secunia.com/secunia_research/2009-5/

Deep Links
Links available in Customer Area