| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Best Buy Printer Ink Coupons -Check the websites of brands like Brother, Canon, or Epson for mail-in rebates that can be applied to purchases made at authorized retailers like Best Buy. Alternative Retailers with Active Coupons You can earn reward points toward future purchases by recycling your empty ink and toner cartridges at any Best Buy location. best buy printer ink coupons Frequently provides higher-value codes, such as $20 off a $100 purchase (Code: YES20) or $30 off $150 (Code: YES30). 20% Off or More Printer Ink - Best Buy Check the websites of brands like Brother, Canon, Signing up for automated ink delivery through Best Buy can sometimes unlock additional percentage-based discounts on every shipment. Manufacturer Coupons and Promotions 20% Off or More Printer Ink - Best Members often receive exclusive lower pricing on ink and toner. Membership also provides benefits like free two-day shipping, which can save you on delivery costs for small ink orders.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |