FreeFloat FTP Server Buffer Overflow Vulnerability in LS Command Handler

A critical buffer overflow vulnerability has been identified in FreeFloat FTP Server version 1.0. The issue arises in the LS Command Handler component, where the server improperly validates the size of input buffers before copying them to output buffers. This oversight allows for remote exploitation of the vulnerability, potentially leading to arbitrary code execution.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can be leveraged to execute arbitrary code on the server.

Reproduction

The vulnerability can be reproduced by sending a crafted 'LS' command that includes a payload designed to overflow the buffer. This can be done using a Perl script that establishes a TCP connection to the FTP server, sends the 'USER' and 'PASS' commands to authenticate (no authentication is actually required), and then sends the 'LS' command with the payload. The payload should be carefully crafted to include the necessary offset and overwrite the return address with a location that allows for code execution, such as a jump instruction to a shellcode payload.