Re: ftp.exe buffer overflow ?

[Lincoln Yeoh <lyeoh () POP JARING MY>]

At 08:45 PM 2/11/01 -0500, Michal Zalewski wrote:
> On Mon, 12 Feb 2001, Egemen Tas wrote:
>
> > This bug is different from the ones you mentioned..
> > This is the bug in MS FTP Client's QUOTE command.
>
> MS FTP client is surprisingly similar to BSDish ftp client, containing -
> for example - some similar strings in its binary. It's been discussed on

> > but does not pose great security risk.Because ftp.exe runs with the
> > credidentals of currently logged on user.

> Right =)

But for windows 9x the currently logged on user is effectively "root" or
"administrator" on the local machine.

Still it's not as bad as if that ftp client bug was in IE or Netscape - in
which case a site could trigger it with less chance of the user noticing.

Cheerio,
Link.