Description
Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual server configuration to trigger a buffer overflow that corrupts the SEH chain and enables potential code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Xlightftpd | Xlight | 3.9.1 | — |
References
- ExploitDB-46458 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Xlight FTP Server 3.9.1 SEH Overwrite Buffer Overflow third-party-advisory