A local buffer overflow vulnerability in FTPDummy 4.80 allows unauthenticated attackers to achieve arbitrary code execution by providing a specially crafted preference file.

This is a classic buffer overflow (CWE-120) triggered when the application processes a malformed preference file. The vulnerability exists in the handling of preference data, allowing an attacker to overwrite the structured exception handler and execute arbitrary system commands.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code with the privileges of the user running the FTPDummy application. This can lead to full system compromise, unauthorized data access, or the deployment of persistent malware within the local environment. Given the high CVSS score of 8.4, this represents a significant risk to the integrity and confidentiality of the host machine.

Immediate Action: Update to the latest version of FTPDummy provided by K.soft, or disable the application if a patch is not currently available for your specific deployment.

Proactive Monitoring: Monitor system logs for unauthorized file modifications or unexpected application crashes that may indicate an attempt to trigger the overflow condition.

Compensating Controls: Ensure that the application is executed with the least privilege necessary, and use host-based security tools to restrict the ability of the application to read files from untrusted or user-writable directories.

Public Exploit Available: Yes, a public proof-of-concept exploit is available via ExploitDB (EDB-ID 48685).

Users of FTPDummy 4.80 must treat this vulnerability with high priority due to the availability of functional exploit code. Organizations should identify all instances of the software and apply the vendor-supplied security updates immediately. If patching is not feasible, restrict access to the application installation directory to prevent the placement of malicious preference files by unauthorized users.