----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Free Download Manager Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA33524

VERIFY ADVISORY:
http://secunia.com/advisories/33524/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
Free Download Manager (FDM) 3.x
http://secunia.com/advisories/product/21004/
Free Download Manager 2.x
http://secunia.com/advisories/product/15726/

DESCRIPTION:
Secunia Research has discovered some vulnerabilities in Free Download
Manager, which can be exploited by malicious people to compromise a
user's system.

1) A boundary error in the parsing of file names inside torrent files
can be exploited to cause a heap-based buffer overflow by e.g.
tricking a user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other
versions may also be affected.

2) Two boundary errors when parsing names from torrent files can be
exploited to cause stack-based buffer overflows by e.g. tricking a
user into opening a specially crafted torrent file.

The vulnerabilities are confirmed in versions 2.5 Build 758 and 3.0
Build 844. Other versions may also be affected.

3) A boundary error in the Remote Control Server when processing
"Authorization" headers in HTTP requests can be exploited to cause a
stack-based buffer overflow via an HTTP request containing an overly
long "Authorization" header.

The vulnerability is confirmed in versions 2.5 Build 758 and 3.0
Build 844. Other versions may also be affected.

NOTE: The vendor states that the remote control service can be used
to connect remotely to the system over the Internet. However, since
basic authorization is used for transmitting credentials, users
should be aware that anyone able to intercept the traffic can gain
knowledge of the username and password.

4) A boundary error when parsing tracker URLs from torrent files can
be exploited to cause a stack-based buffer overflow by e.g. tricking
a user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other
versions may also be affected.

5) A boundary error when parsing comments from torrent files can be
exploited to cause a stack-based buffer overflow by e.g. tricking a
user into opening a specially crafted torrent file.

The vulnerability is confirmed in version 3.0 Build 844. Other
versions may also be affected.

Successful exploitation of the vulnerabilities allows execution of
arbitrary code.

SOLUTION:
Update to version 3.0 build 848.

PROVIDED AND/OR DISCOVERED BY:
Carsten Eiram, Secunia Research.

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2009-3/
http://secunia.com/secunia_research/2009-5/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------