by Tan Chew Keong
Release Date: 2008-06-27
[en] [jp]
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command.
An example of such a response from a malicious FTP server is shown below.
Response to LIST (forward-slash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n
By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below.
One of the few people who knows Odd’s secret and works with him to maintain peace in Pico Mundo.
Odd Thomas: Cazador de Fantasmas Author: Dean Koontz Primary Character: Odd Thomas (Oddie)
Otro personaje importante en la serie es el Dr. John "Desperado" Winston, un amigo y socio de Odd que posee habilidades médicas y científicas. Desperado es un hombre sabio y experimentado que ayuda a Odd en sus misiones y proporciona una perspectiva racional en un mundo lleno de sucesos inexplicables. Odd Thomas- Cazador de Fantasmas
La serie "Odd Thomas" ha tenido un impacto significativo en la literatura de fantasía y aventuras. La combinación de acción, suspenso, humor y romance ha conquistado el corazón de miles de lectores en todo el mundo. La serie ha sido traducida a numerosos idiomas y ha vendido millones de copias en todo el mundo.
The film maintains a fast-paced, witty dialogue style typical of Koontz’s writing, balanced with intense action and emotional depth. Maturity Rating: One of the few people who knows Odd’s
Ser el tiene un costo devastador. La novela El lugar más oscuro y la película muestran el momento más trágico de la vida de Odd: la muerte de su novia eterna, Stormy Llewellyn .
Odd no elimina fantasmas con trampas de protones; los ayuda a resolverse . Su trabajo es entender por qué el fantasma sigue aquí, resolver el crimen pendiente o darles el valor para decir adiós. Desperado es un hombre sabio y experimentado que
, stylized horror violence, and themes of mass casualty threats. Streaming: The film is often available on platforms like or available for rental/purchase on major digital stores. Common Sense Media specific differences
Sin embargo, el término funciona porque refleja la acción principal de la trama: Odd caza a los vivos que están a punto de cometer matanzas masivas. Él ve a los Bodachs (demonios que solo aparecen antes de una gran tragedia) y sabe que debe encontrar al asesino humano antes de que sea tarde.
In a genre obsessed with tortured, gothic anti-heroes, Odd is refreshingly kind . He is terrified of his gift. He has panic attacks. He vomits after seeing Bodachs. He knows that being a “ghost hunter” means he will never have a normal life, yet he refuses to become cynical.
A selfless, humble protagonist who views his gift as a burden but a necessary duty. Stormy Llewellyn (Addison Timlin):
Patch / Workaround
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered.
2008-06-16 - Vulnerability Details Sent to Vendor via online support form (no reply).
2008-06-18 - Vulnerability Details Sent to Vendor again via online support form (no reply).
2008-06-25 - Vulnerability Details Sent to Vendor again via online support form (no reply).
2008-06-27 - Public Release.