FreeFloat FTP Server Buffer Overflow Vulnerability in BYE Command Handler

A critical buffer overflow vulnerability has been identified in FreeFloat FTP Server version 1.0. The issue arises in an unknown function of the BYE Command Handler, allowing for remote exploitation. The vulnerability has been publicly disclosed and is actively exploitable.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or causing a crash.

Reproduction

The vulnerability can be reproduced by sending a crafted BYE command that includes a payload designed to overflow the buffer. This can be done using a TCP connection to the FTP server's port 21. The payload must be carefully crafted to include the desired shellcode after the buffer overflow, exploiting the vulnerability by overwriting the return address with a location that points to the shellcode.