A buffer overflow vulnerability in FileOptimizer 14.00.2524 allows unauthenticated attackers to cause a denial of service by manipulating configuration files.

The application contains a denial of service vulnerability due to improper handling of the TempDirectory parameter within the FileOptimizer32.ini configuration file. An attacker can overwrite this parameter with a 5000-character buffer, causing the application to crash when the user accesses the Options menu.

Successful exploitation results in a denial of service, rendering the FileOptimizer application unusable. While this does not lead to remote code execution or data theft, it disrupts operations and impacts system availability. Given the CVSS score of 7.5, this is considered a High severity issue that requires attention to maintain system stability and reliability.

Immediate Action: Upgrade to the latest available version of FileOptimizer to ensure the configuration file handling mechanism is secured.

Proactive Monitoring: Monitor local system logs and application error reporting for signs of unexpected crashes or abnormal configuration file modifications.

Compensating Controls: Restrict write access to the application installation directory and associated .ini configuration files to prevent unauthorized modification by low-privileged users or malicious processes.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 47586.

This vulnerability presents a clear risk to application availability through a simple buffer overflow attack. Organizations utilizing FileOptimizer 14.00.2524 should prioritize updating to a newer version where this flaw is addressed. Until an update is applied, ensure that access to the application directory is strictly controlled to prevent unauthorized modification of the configuration files.