VULNERABILITIES / FIXES - March 01, 2012
by Carol~ - 3/1/12 7:03 AM
Ricoh DC Software DL-10 FTP Server Buffer Overflow Vulnerability
Release Date : 2012-03-01
Criticality level : Moderately critical
Impact : System access
Where : From local network
Solution Status : Unpatched
Software: Ricoh DC Software DL-10 4.x
Julien Ahrens has discovered a vulnerability in Ricoh DC Software DL-10, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error in the SR10 FTP server when logging FTP commands. This can be exploited to cause a stack-based buffer overflow via e.g. an overly long "USER" FTP command.
Successful exploitation allows execution of arbitrary code, but requires the "Log file name" option to be enabled (disabled by default).
The vulnerability is confirmed in version 220.127.116.11 (SR10.exe 18.104.22.168). Other versions may also be affected.
Restrict access to trusted hosts only or disable the "Log file name" option.
Provided and/or discovered by:
Julien Ahrens via Secunia.