PCMan FTP Server Buffer Overflow Vulnerability in SYST Command Handler

A critical buffer overflow vulnerability has been identified in PCMan FTP Server version 2.0.7. The issue arises from an unknown processing flaw in the SYST Command Handler, allowing remote attackers to manipulate the command and cause a buffer overflow. This vulnerability has been publicly disclosed and could be exploited remotely.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing the application to crash.

Reproduction

The vulnerability can be reproduced by sending a crafted SYST command that includes a payload designed to overflow the buffer. This can be done using a TCP connection to the FTP server's port 21. The payload should be carefully crafted to include the desired shellcode after the overflow, aiming to overwrite the instruction pointer and execute the shellcode. The exploit can be automated with a script that handles the connection and payload delivery.