FreeFloat FTP Server Buffer Overflow Vulnerability in LCD Command Handler

A critical buffer overflow vulnerability has been identified in FreeFloat FTP Server version 1.0. The issue arises in the LCD Command Handler component, allowing remote exploitation. The vulnerability has been publicly disclosed and could be actively exploited.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a crash, depending on how the overflow is handled.

Reproduction

The vulnerability can be reproduced by sending a crafted 'lcd' command to the FTP server. The command should include a payload that exploits the buffer overflow vulnerability. This can be done using a Perl script that creates a socket connection to the FTP server, sends the 'USER' and 'PASS' commands to authenticate, and then sends the 'lcd' command with the payload. The payload should be carefully crafted to include the necessary offset to overwrite the return address and execute the injected code.