Jan-Olivier Filiols and Philippe Oechslin have reported a vulnerability in PlatinumFTPServer, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.

The vulnerability is caused due to a format string error within the handling of arguments passed to various FTP commands and can be exploited by e.g. passing a specially crafted string containing format specifiers to the "USER" or "PASS" commands.

Successful exploitation may allow execution of arbitrary code.

The vulnerability has been reported in version 1.0.18. Prior versions may also be affected.

The FTP server is based on a component from Mabry Software and this vulnerability is therefore related to:
SA10608

Solution
Upgrade to PlatinumFTP 2007.

Provided and/or discovered by
Jan-Olivier Filiols and Philippe Oechslin.

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area