Free Download Manager Multiple Vulnerabilities

[Peaches]

Free Download Manager Multiple Vulnerabilities Secunia Advisory: SA33524

Release Date: 2009-02-02

Critical:

Highly critical Impact: System access

Where: From remote Solution Status: Vendor Patch

Software: Free Download Manager (FDM) 3.x

Free Download Manager 2.x

Binary Analysis: BA657 :: Available for 1 Credit

BA640 :: Available for 1 Credit

BA662 :: Available for 1 Credit

Subscribe: Instant alerts on relevant vulnerabilities

CVE reference: CVE-2009-0183

CVE-2009-0184

Description:

Secunia Research has discovered some vulnerabilities in Free Download Manager, which can be exploited by malicious people to compromise a user's system.

1) A boundary error in the parsing of file names inside torrent files can be exploited to cause a heap-based buffer overflow by e.g. tricking a user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other versions may also be affected.

2) Two boundary errors when parsing names from torrent files can be exploited to cause stack-based buffer overflows by e.g. tricking a user into opening a specially crafted torrent file.

The vulnerabilities are confirmed in versions 2.5 Build 758 and 3.0 Build 844. Other versions may also be affected.

3) A boundary error in the Remote Control Server when processing "Authorization" headers in HTTP requests can be exploited to cause a stack-based buffer overflow via an HTTP request containing an overly long "Authorization" header.

The vulnerability is confirmed in versions 2.5 Build 758 and 3.0 Build 844. Other versions may also be affected.

NOTE: The vendor states that the remote control service can be used to connect remotely to the system over the Internet. However, since basic authorization is used for transmitting credentials, users should be aware that anyone able to intercept the traffic can gain knowledge of the username and password.

4) A boundary error when parsing tracker URLs from torrent files can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other versions may also be affected.

5) A boundary error when parsing comments from torrent files can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other versions may also be affected.

Successful exploitation of the vulnerabilities allows execution of arbitrary code.

Solution:

Update to version 3.0 build 848.

Provided and/or discovered by:

Carsten Eiram, Secunia Research.

Original Advisory:

Secunia Research:

http://secunia.com/secunia_research/2009-3/

http://secunia.com/secunia_research/2009-5/ Source: Secunia Advisory: http://secunia.com/advisories/33524/