CVE-2004-1118 in WeOnlyDo!
Summary
by MITRE
Buffer overflow in the WodFtpDLX.ocx (WeOnlyDo!) ActiveX component before 2.3.2.97, as used by CoffeeCup Direct FTP 6.2.0.62 and CoffeeCup Free FTP 3.0.0.10, and possibly other applications, allows remote attackers to execute arbitrary code via a long filename.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/17/2025
The vulnerability identified as CVE-2004-1118 represents a critical buffer overflow condition within the WodFtpDLX.ocx ActiveX control developed by WeOnlyDo. This specific ActiveX component was integrated into popular file transfer applications including CoffeeCup Direct FTP 6.2.0.62 and CoffeeCup Free FTP 3.0.0.10, creating a widespread security risk across multiple software implementations. The flaw manifests when the ActiveX control processes filename inputs without adequate bounds checking, allowing attackers to supply excessively long filename strings that exceed the allocated buffer space. This particular vulnerability falls under CWE-121, which specifically addresses stack-based buffer overflow conditions, and aligns with ATT&CK technique T1190 for Exploit Public-Facing Application, as it exploits a component within a widely deployed application. The affected ActiveX control was designed to handle file transfer operations through the WeOnlyDo framework, which provided a set of COM components for internet-based file operations including ftp and http protocols.
The technical implementation of this buffer overflow occurs at the memory management level where the WodFtpDLX.ocx component fails to validate the length of filename strings passed to its internal processing functions. When a maliciously crafted filename exceeds the predetermined buffer limits, the overflow causes adjacent memory locations to be overwritten, potentially corrupting critical program execution data such as return addresses, stack pointers, or function pointers. The vulnerability is particularly dangerous because it can be triggered through remote exploitation, meaning attackers do not need physical access to the target system. The attack vector typically involves constructing a specially crafted filename that, when processed by the vulnerable ActiveX control, triggers the buffer overflow condition. This allows attackers to execute arbitrary code with the privileges of the user running the vulnerable application, which typically runs with the same permissions as the user account. The memory corruption can be leveraged to overwrite the instruction pointer, redirecting program execution to malicious code injected into the buffer overflow area.
The operational impact of CVE-2004-1118 extends beyond simple code execution to encompass complete system compromise when exploited successfully. Attackers can leverage this vulnerability to install backdoors, steal sensitive data, or perform further exploitation within the compromised network. The vulnerability affects not only the specific versions mentioned but potentially other applications that utilize the same vulnerable ActiveX control, creating an extensive attack surface. Since ActiveX controls are commonly used in web browsers and desktop applications, the exploitation potential is significant, particularly in corporate environments where multiple applications may be vulnerable. The attack requires minimal user interaction beyond visiting a malicious website or opening a specially crafted file, making it particularly dangerous for end users. Organizations running affected versions of CoffeeCup FTP applications face potential data breaches, system compromise, and unauthorized access to network resources, as the vulnerability allows for privilege escalation and persistent access to target systems.
The recommended mitigation strategy for CVE-2004-1118 involves immediate patching of the vulnerable WodFtpDLX.ocx component to version 2.3.2.97 or later, which contains the necessary buffer overflow protections. System administrators should also implement browser security configurations that restrict ActiveX control usage, particularly for untrusted websites. The principle of least privilege should be enforced by running vulnerable applications with minimal required permissions, limiting the potential impact of successful exploitation. Network segmentation and firewall rules can help reduce the attack surface by limiting access to systems running vulnerable applications. Additionally, security awareness training for users can help prevent accidental exploitation through social engineering attacks that might involve visiting malicious websites or opening suspicious files. Organizations should also implement regular vulnerability scanning and patch management processes to identify and remediate similar vulnerabilities in other software components. The remediation process should include comprehensive testing of patched versions to ensure that security updates do not introduce compatibility issues with existing workflows or system functionality.