PT-2012-5710 · Flashfxp · Flashfxp

Benjamin Kunz Mejri · Publicado 2012-09-19 · Atualizado 2017-08-29 · CVE-2012-4992

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FlashFXP version 4.2

Description The issue is related to multiple buffer overflows in FlashFXP.exe, which can be exploited by remote authenticated users to execute arbitrary code. This can be achieved by sending a long unicode string to either the TListbox or the TComboBox.

Recommendations For FlashFXP version 4.2, consider updating to a newer version that addresses these buffer overflows, as using a long unicode string in TListbox or TComboBox can lead to arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-4992

Produtos afetados

Flashfxp

Referências · 10

• 🔥 http://seclists.org/fulldisclosure/2012/Mar/7 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-03/0002.html · Exploit
• 🔥 http://exploit-db.com/exploits/18555 · Exploit
• 🔥 https://exploit-db.com/exploits/18555 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73626 · Nota
• http://vulnerability-lab.com/get_content.php?id=462 · Nota
• http://flashfxp.com/forum/news/15473-flashfxp-4-2-released.html#post81101 · Nota
• http://osvdb.org/79767 · Nota
• http://securityfocus.com/bid/52259 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4992 · Nota de Segurança