Turbo FTP Server Buffer Overflow Vulnerability in PORT Command Allowing Remote Code Execution

A buffer overflow vulnerability has been identified in Turbo FTP Server versions 1.30.823 and 1.30.826. The issue arises in the handling of the PORT command, where an unauthenticated remote attacker can send a specially crafted payload to overwrite memory structures. This exploitation allows for arbitrary code execution with SYSTEM privileges.

Impact

Exploitation of this vulnerability leads to a buffer overflow, allowing for arbitrary code execution with SYSTEM privileges on the affected machine.

Reproduction

The vulnerability can be reproduced by sending a crafted PORT command that exploits the buffer overflow. This can be done using a Metasploit module designed for this purpose, which automates the exploitation process by sending the appropriate payloads to the FTP server.