Description
Gekko Manager FTP Client <= 0.77 contains a stack-based buffer overflow in its FTP directory listing parser. When processing a server response to a LIST command, the client fails to properly validate the length of filenames. A crafted response containing an overly long filename can overwrite the Structured Exception Handler (SEH), potentially allowing remote code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
New Software S.C. Gekko Manager FTP Client
Default version status: unaffected
0 to ≤ 0.77affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/gekkomgr_list_reply.rb ↗
- https://www.exploit-db.com/exploits/16728 ↗
- https://www.gekkomanager.com/ ↗
- https://web.archive.org/web/20111016194057/https://www.corelan.be/index.php/2010/10/12/death-of-an-ftp-client/ ↗
- https://www.vulncheck.com/advisories/gekko-manager-ftp-client-stack-buffer-overflow ↗