CVE-2010-20034: Gekko Manager FTP Client <= 0.77 contains a stack-based buffer overflow in its FTP directory listing parser. When processing a server response to a LIST…

PriorityP352high8.5CVSS 4.0

AVLACLATNPRNUIPVCHVIHVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX

EXPLOIT

EPSS

0.48%

37.5th percentile

Gekko Manager FTP Client <= 0.77 contains a stack-based buffer overflow in its FTP directory listing parser. When processing a server response to a LIST command, the client fails to properly validate the length of filenames. A crafted response containing an overly long filename can overwrite the Structured Exception Handler (SEH), potentially allowing remote code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
new_software_s.c	gekko_manager_ftp_client	<= 0.77	—

Detection & IOCsextracted from sources · hover to see the quote

versionGekko Manager FTP Client <= 0.77↗

urlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ftp/gekkomgr_list_reply.rb↗

→Monitor FTP LIST command responses containing anomalously long filenames directed at Gekko Manager FTP Client processes; oversized filenames in LIST replies are the trigger for the overflow. ↗
→Look for SEH (Structured Exception Handler) chain corruption in the context of the Gekko Manager FTP client process following receipt of a LIST response from an FTP server. ↗
→A rogue/malicious FTP server returning a crafted LIST reply with an excessively long filename to a connecting Gekko Manager client is the attack vector; flag outbound FTP connections from Gekko Manager to untrusted servers. ↗

·Exploitation requires the victim Gekko Manager FTP client to connect to and receive a LIST response from an attacker-controlled (rogue) FTP server; the vulnerability is client-side and triggered only upon processing the server's reply. ↗
·The overflow specifically targets the SEH chain (SEH overwrite), not a standard return address overwrite; detection/exploit mitigations should account for SEH-based exploitation techniques. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.