CVE-2025-3379: Pcman Ftp Server Buffer Overflow Flaw

CVE-2025-3379 Overview

CVE-2025-3379 is a buffer overflow vulnerability in PCMan FTP Server 2.0.7. The flaw resides in the EPSV (Extended Passive Mode) command handler. An unauthenticated remote attacker can send a malformed EPSV command to trigger memory corruption in the FTP service. The vulnerability has been publicly disclosed, and exploit details are available on third-party research sites. The weakness is classified as [CWE-119], improper restriction of operations within the bounds of a memory buffer.

Critical Impact
Remote attackers can exploit the EPSV command handler over the network without authentication or user interaction, leading to buffer overflow conditions that may corrupt process memory and disrupt FTP service availability.

Affected Products

PCMan FTP Server version 2.0.7
Component: EPSV Command Handler
Vendor: PCMan

Discovery Timeline

2025-04-07 - CVE-2025-3379 published to NVD
2025-04-29 - Last updated in NVD database

Technical Details for CVE-2025-3379

Vulnerability Analysis

The vulnerability exists in the EPSV command handler of PCMan FTP Server 2.0.7. The EPSV command, defined in [RFC 2428], instructs an FTP server to listen on a data port and enter passive mode. The server fails to validate the length or content of arguments supplied with the EPSV command. Attackers can submit an overlong string to overflow a fixed-size buffer in the server process. The EPSS score of 0.479% places this issue in the 65th percentile for exploitation likelihood.

Root Cause

The root cause is missing bounds checking in the FTP command parser. When the EPSV handler copies user-supplied argument data into a stack or heap buffer, it does not enforce a maximum length. This [CWE-119] memory corruption pattern is common in legacy C/C++ network services that rely on unsafe string functions such as strcpy or sprintf.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker establishes an FTP control connection to the listening service and issues a crafted EPSV command with an oversized argument. The malformed command overflows the receiving buffer, corrupting adjacent memory regions. The result can range from service crash to memory corruption that affects process integrity.

No verified proof-of-concept code is included here. See the Fitoxs Exploit Report and VulDB entry #303625 for technical disclosure details.

Detection Methods for CVE-2025-3379

Indicators of Compromise

Unexpected termination or repeated crashes of the PCManFTP.exe process on Windows hosts running version 2.0.7.
FTP control session logs showing EPSV commands with abnormally long argument strings.
Inbound TCP connections to port 21 from untrusted sources immediately preceding service restarts.

Detection Strategies

Inspect FTP traffic at the network perimeter for EPSV commands containing arguments that exceed expected protocol length.
Correlate Windows Application event log entries for PCManFTP.exe faults with concurrent inbound FTP sessions.
Deploy network IDS signatures that flag malformed FTP command sequences targeting passive-mode handlers.

Monitoring Recommendations

Enable verbose FTP command logging and forward logs to a centralized SIEM for analysis.
Monitor for crash dumps generated by the FTP service and alert on repeat occurrences within short time windows.
Track outbound connections from hosts running PCMan FTP Server to identify post-exploitation activity.

How to Mitigate CVE-2025-3379

Immediate Actions Required

Restrict network access to the FTP service using host-based firewalls or perimeter access control lists, limiting connections to trusted source addresses only.
Decommission PCMan FTP Server 2.0.7 instances exposed to the public internet, as the product has limited active maintenance.
Migrate hosted FTP workloads to a maintained alternative such as vsftpd, FileZilla Server, or Microsoft IIS FTP.

Patch Information

No vendor patch is listed in the available advisory references for CVE-2025-3379. Review the VulDB entry #303625 and the VulDB CTI report for any updates to remediation guidance. Until a vendor fix is available, treat the affected version as end-of-support and remove it from production environments.

Workarounds

Block inbound TCP port 21 at the network boundary where FTP services are not required for business operations.
Place the FTP server behind a VPN or zero-trust access gateway to require authenticated tunnels before exposure.
Use an FTP-aware application proxy that strips or normalizes EPSV commands with excessive argument length.

bash

# Configuration example: block external FTP access on Windows host
netsh advfirewall firewall add rule name="Block-Inbound-FTP-21" \
  dir=in action=block protocol=TCP localport=21 \
  remoteip=any profile=any