QlikView Denial-of-Service Vulnerability in FTP Server Address Input

A denial-of-service vulnerability has been identified in QlikView version 12.50.20000.0. The issue resides in the FTP server address input field, where local attackers can crash the application by pasting a 300-character buffer. This exploitation disrupts normal functionality, causing the application to crash.

Impact

Exploitation of this vulnerability leads to a crash of the QlikView application, disrupting normal user activity and causing potential data loss.

Reproduction

To reproduce this vulnerability, open QlikView 12.50.20000.0 on a Windows 10 Pro x64 system. Navigate to 'File' and select 'Open FTP...'. In the 'FTP Server Address' field, paste a 300-character buffer. After pasting, click 'Connect', which will trigger the application to crash.