Two vulnerabilities have been reported in UMN GopherD, which can be exploited by malicious people to compromise a vulnerable system.

A boundary error in the FTP gateway ("ftp.c") in the "GopherFile()" function can be exploited by issuing the "LIST" command to a FTP server containing a file with an overly long, specially crafted filename. This results in a buffer overflow and may allow execution of arbitrary code.

Another boundary error is located in the "GSisText()" function used to determine view types. This can be exploited by supplying an overly long, specially crafted string, which will cause a buffer overflow and allow execution of arbitrary code.

The following versions have been reported vulnerable:
- v3.0.5, v3.0.4, v3.0.3, v3.0.2, v3.0.1, v3.0.0(-1)
- v2.3.1. (patch level 0 through 15)

Other versions may also be affected.

Solution
Use another product.

Provided and/or discovered by
Vade 79

Changelog
Further details available in Customer Area

Original Advisory
http://fakehalo.deadpig.org/xgopherd2k3-ftp.c
http://fakehalo.deadpig.org/xgopherd2k3-view.c

Deep Links
Links available in Customer Area