Re: Buffer overflow in Microsoft ftp.exe

From: <rdusek(at)myway.com>
Date: Wed Apr 30 2003 - 12:30:17 EDT

('binary' encoding is not supported, stored as-is)
In-Reply-To: <Law8-F50RC6HixqDCZx0000a7f4@hotmail.com>

>if an attacker with axx to the system is able to modify the scriptfile
he
>can modify the script and place an evil command Quote
AAAAAA..SHELLCODE...
>and execute code with elevated privileges.

The attacker would only be executing code in the context of the user running FTP.exe... Not necessarily elevated privileges.

-Robert Dusek Received on Wed Apr 30 17:36:56 2003