PCMan FTP Server Buffer Overflow Vulnerability in HASH Command Handler

A critical buffer overflow vulnerability has been identified in PCMan FTP Server version 2.0.7. This issue arises in the HASH Command Handler component, where an unknown functionality can be manipulated to cause a buffer overflow. The vulnerability can be exploited remotely, and the details of the exploit have been disclosed publicly.

Impact

Exploitation of this vulnerability leads to a remote buffer overflow, which can commonly result in arbitrary code execution or causing a crash of the application.

Reproduction

The vulnerability can be reproduced by connecting to the FTP server on port 21 and authenticating with the USER and PASS commands. After establishing the connection, the HASH command can be sent with a crafted payload that exploits the buffer overflow vulnerability. The payload should be carefully constructed to overwrite the return address and execute arbitrary code.