FTP Navigator Denial-of-Service Vulnerability via Structured Exception Handler Overwrite

A denial-of-service vulnerability has been identified in FTP Navigator version 8.03. This issue allows attackers to crash the application by overwriting the Structured Exception Handler (SEH) with malicious input. The vulnerability can be exploited by generating a payload consisting of 4108 'A' characters, followed by 4 'B' characters and 40 'C' characters. When this payload is pasted into the custom command input, it triggers a program crash by overwriting the SEH, causing a stack-based buffer overflow.

Impact

Exploitation of this vulnerability leads to a program crash, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, first create a payload of 4108 'A' characters, followed by 4 'B' characters and 40 'C' characters. Save this payload to a file. Then, open FTP Navigator 8.03 and navigate to 'FTP - Server' > 'Custom Command'. Paste the payload into the input box below 'SERVER LIST' and press 'Do it!'. The application will crash, demonstrating the denial-of-service vulnerability by overwriting the Structured Exception Handler.