Secunia

Peter Winter-Smith has reported a vulnerability in Windows Ftp Server, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerability is caused due to a format string error when processing client data. This can e.g. be exploited by supplying a specially crafted username containing format specifiers when attempting to log in.

Successful exploitation may crash the process or potentially allow execution of arbitrary code.

The vulnerability has been reported in version 1.6 and prior.

NOTE: This is not the default FTP server included in some versions of the Microsoft Windows operating system.

Solution
Restrict traffic to the service, allowing only trusted IP addresses to connect.
Further details available in Customer Area

Provided and/or discovered by
Peter Winter-Smith

Original Advisory
http://www.elitehaven.net/winftpserver.txt

Deep Links
Links available in Customer Area