Secunia

Multiple vulnerabilities have been reported in NGC Active FTPServer, which can be exploited by malicious people to cause a DoS (Denial of Service) on a vulnerable system or potentially compromise it.

The vulnerabilities are caused due to boundary errors when handling input for various commands. A malicious person can reportedly exploit this to cause a buffer overflow by supplying more than 25001 bytes of input to the "USER" command. This will cause the FTP server to crash and may potentially allow execution of arbitrary code.

Malicious, authenticated users can also exploit the following commands to cause buffer overflows:
- CWD
- LS
- GET
- MKDIR

The vulnerabilities have been reported in version 2.40. However, prior versions may also be affected.

Solution
Reportedly, the vendor states that the vulnerabilities will be fixed in the next version (2003), which will be released in August.
Further details available in Customer Area

Provided and/or discovered by
Ziv Kamir

Deep Links
Links available in Customer Area