Multiple third-party graphical FTP clients contain various buffer overflows that allow a malicious FTP server to execute arbitrary code on the client system. The list below describes the type of server data that triggers the overflow for each affected client application, and indicates whether the overflow is stack-based or heap-based.

(1) FlashFXP 2.0 build 905

- Server response to a client's PASV command (stack)

- Overlong hostname provided by server (stack)

(2) SmartFTP 1.0.973

- Server response to a client's PWD command (stack)

- Server response to a client's LIST command (heap)

(3) LeapFTP 2.7.3.600

- Server response to a client's PASV command (stack)

(4) FTP Voyager 10.0.0.0

- Server response to a client's LIST command (stack)

Risk: Remote compromise of an FTP client system by a malicious FTP server. Successful attackers gain the privileges of the user running the client program.

Deployment: Significant.

According to CNet/Download.com on 6/12/03, the affected client software has been collectively downloaded more than 7 million times.

FlashFXP: 619,289 downloads

SmartFTP: 2,361,990 downloads

LeapFTP: 262,167 downloads

FTP Voyager: 4,519,874 downloads

Ease of Exploitation: Straightforward.

Most overflows are stack-based, and sufficient details are available for an attacker to begin crafting exploit code.

Status: In all cases the advisories indicate that the vendor has released fixed versions of the affected software.