Secunia Research has discovered some vulnerabilities in Free Download Manager, which can be exploited by malicious people to compromise a user's system.

1) A boundary error when opening folders within the "Site Explorer" functionality can be exploited to cause a stack-based buffer overflow.

2) A boundary error when e.g. opening websites in the "Site Explorer" functionality can be exploited to cause a stack-based buffer overflow.

3) A boundary error when setting the directory on FTP servers can be exploited to cause a stack-based buffer overflow.

4) A boundary error when handling redirects can be exploited to cause a stack-based buffer overflow.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

5) The application does not properly sanitise the "name" attribute of the "file" element of metalink files before using it to download files. If a user is tricked into downloading from a specially crafted metalink file, this can be exploited to download files to directories outside of the intended download directory via directory traversal attacks.

The vulnerabilities are confirmed in version 3.0 build 850. Other versions may also be affected.

Solution
Update to version 3.0 build 852.

Provided and/or discovered by
Stefan Cornelius, Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2010-67/
http://secunia.com/secunia_research/2010-68/

Technical Analysis
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers