PT-2014-4475 · Free Download Manager Team · Free Download Manager

Julien Ahrens · Published 2014-03-18 · Updated 2018-10-09 · CVE-2014-2087

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Free Download Manager versions 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier

Description The issue is related to a stack-based buffer overflow in the CDownloads Deleted::UpdateDownload function. This allows remote attackers to execute arbitrary code via a long file name, which is then deleted from the download queue by the user.

Recommendations For Free Download Manager versions 3.9.3 build 1360, 3.8 build 1173, 3.0 build 852, and earlier, consider avoiding the use of long file names in the download queue until a fix is available. As a temporary workaround, restrict the ability to delete files from the download queue to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2014-2087

Affected Products

Free Download Manager

References · 6

• 🔥 https://exploit-db.com/exploits/32332 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Mar/137 · Exploit
• 🔥 http://securityfocus.com/bid/66211 · Exploit
• 🔥 https://rcesecurity.com/2014/03/cve-2014-2087-free-download-manager-cdownloads_deleted-updatedownload-remote-code-execution · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2087 · Security Note
• http://securityfocus.com/archive/1/531465/100/0/threaded · Note