Yosef Klein has reported a vulnerability in tnftp, allowing malicious people to overwrite local files.

The vulnerability is caused by lack of validation of file names provided by the server in the "mget()" function. This can be exploited to overwrite arbitrary files by sending a maliciously crafted file name from the ftp server.

Successful exploitation allows overwriting local files, but requires that a user connects to a malicious ftp server and downloads files.

The vulnerability has been reported in tnftp version 20030825 (FreeBSD port). Other versions and ports may also be vulnerable.

Solution
Use another product.
Further details available in Customer Area

Provided and/or discovered by
Yosef Klein

Changelog
Further details available in Customer Area

Original Advisory
http://tigger.uic.edu/~jlongs2/holes/tnftp.txt

Deep Links
Links available in Customer Area