PT-2012-5710 · Flashfxp · Flashfxp

Benjamin Kunz Mejri · Published 2012-09-19 · Updated 2017-08-29 · CVE-2012-4992

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FlashFXP version 4.2

Description The issue is related to multiple buffer overflows in FlashFXP.exe, which can be exploited by remote authenticated users to execute arbitrary code. This can be achieved by sending a long unicode string to either the TListbox or the TComboBox.

Recommendations For FlashFXP version 4.2, consider updating to a newer version that addresses these buffer overflows, as using a long unicode string in TListbox or TComboBox can lead to arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-4992

Affected Products

Flashfxp

References · 10

• 🔥 http://seclists.org/fulldisclosure/2012/Mar/7 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-03/0002.html · Exploit
• 🔥 http://exploit-db.com/exploits/18555 · Exploit
• 🔥 https://exploit-db.com/exploits/18555 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-4992 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73626 · Note
• http://vulnerability-lab.com/get_content.php?id=462 · Note
• http://flashfxp.com/forum/news/15473-flashfxp-4-2-released.html#post81101 · Note
• http://osvdb.org/79767 · Note
• http://securityfocus.com/bid/52259 · Note