BulletProof FTP Server Denial-of-Service Vulnerability in SMTP Configuration Interface

A denial-of-service vulnerability has been identified in BulletProof FTP Server version 2019.0.0.50. The issue resides in the SMTP configuration interface, where local attackers can cause the application to crash by sending an oversized string. Specifically, a buffer of 257 'A' characters can be entered into the SMTP Server field. When the Test button is clicked, the application crashes.

Impact

Exploitation of this vulnerability leads to a crash of the BulletProof FTP Server application, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by entering 257 'A' characters into the SMTP Server field of the SMTP configuration interface. After pasting the oversized string, clicking the Test button will trigger the application to crash.