Parvez Anwar has discovered a vulnerability in Telnet - FTP Server, which can be exploited by malicious users to gain access to sensitive information or cause a DoS (Denial of Service).

1) An input validation error in various commands (e.g. GET and PUT) can be exploited to list and download arbitrary files outside of the FTP root via directory traversal attacks.

2) An error in the handling of the "RETR" command can be exploited to crash the service by sending two successive RETR commands.

The vulnerabilities are confirmed in version 1.0 (build 1.250). Other versions may also be affected.

Solution
Grant access to trusted users only.

Provided and/or discovered by
Parvez Anwar

Changelog
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers