BulletProof FTP Server Denial-of-Service Vulnerability in DNS Address Field

A denial-of-service vulnerability has been identified in BulletProof FTP Server version 2019.0.0.50. The issue arises in the DNS Address field within the Firewall settings, where local attackers can cause the application to crash by entering an excessively long string. Exploitation involves enabling the DNS Address option and pasting a buffer of 700 bytes, which triggers a crash when the Test function is activated.

Impact

Exploiting this vulnerability leads to a crash of the BulletProof FTP Server application, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by enabling the DNS Address option in the Firewall settings and pasting a 700-byte buffer into the DNS Address field. When the Test function is invoked, the application crashes.