PT-2014-4475 · Free Download Manager Team · Free Download Manager

Julien Ahrens · Publicado 2014-03-18 · Atualizado 2018-10-09 · CVE-2014-2087

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Free Download Manager versions 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier

Description The issue is related to a stack-based buffer overflow in the CDownloads Deleted::UpdateDownload function. This allows remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user.

Recommendations For Free Download Manager versions 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier, consider avoiding the use of long file names in the download queue until a fix is available. As a temporary workaround, restrict the ability to delete files from the download queue to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2014-2087

Produtos afetados

Free Download Manager

Referências · 6

• 🔥 https://exploit-db.com/exploits/32332 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Mar/137 · Exploit
• 🔥 http://securityfocus.com/bid/66211 · Exploit
• 🔥 https://rcesecurity.com/2014/03/cve-2014-2087-free-download-manager-cdownloads_deleted-updatedownload-remote-code-execution · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2087 · Nota de Segurança
• http://securityfocus.com/archive/1/531465/100/0/threaded · Nota