Thomas Wana has reported a vulnerability in OpenFTPD, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to a format string error within the "cat_message()" function. This can be exploited via a specially crafted argument to a "SITE MSG" FTP command.

Successful exploitation requires a valid FTP user account.

The vulnerability has been reported in versions up to 0.30.2.

Solution
The vulnerability has been fixed in version 0.30.2:
Further details available to Secunia VIM customers

Provided and/or discovered by
Thomas Wana

Deep Links
Links available to Secunia VIM customers