Two vulnerabilities have been reported in IglooFTP, which can be exploited to substitute uploaded files or overwrite files on the user's system.

1) A weakness when uploading directories recursively can potentially be exploited by malicious, local users to substitute the uploaded files.

2) An input validation error in the "download_selection_recursive()" function when downloading files can be exploited to overwrite arbitrary files on the user's system via specially crafted filenames.

The vulnerabilities have been reported in version 0.6.1. Other versions may also be affected.

Solution
Use another product.

Provided and/or discovered by
1) Manigandan Radhakrishnan
2) Yosef Klein

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://tigger.uic.edu/~jlongs2/holes/iglooftp.txt
http://tigger.uic.edu/~jlongs2/holes/iglooftp2.txt

Deep Links
Links available to Secunia VIM customers