Solaris ftpd glob() Expansion LIST Heap Overflow Vulnerability

The Solaris ftp daemon contains a heap-based buffer overflow condition. The overflow occurs when the LIST command is issued with an argument that expands into an oversized string after being processed by glob().

This buffer overflow occurs in memory that is dynamically allocated. It may be possible for attackers to exploit this vulnerability and execute arbitrary code on the affected host.

To exploit this, the attacker must be able to create directories on the target host.


Privacy Statement
Copyright 2010, SecurityFocus