Secunia

Gynvael Coldwind has discovered a vulnerability in Magellan Explorer, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error when handling the filename of downloaded files through FTP. This can be exploited to e.g. create files in arbitrary locations via directory traversal attacks.

Successful exploitation requires that the user is e.g. tricked into downloading a file with a specially-crafted filename from a malicious FTP server.

The vulnerability is confirmed in version 3.32 Build 2305. Other versions may also be affected.

Solution
Do not connect to untrusted FTP servers.

Provided and/or discovered by
Gynvael Coldwind, Hispasec

Changelog
Further details available in Customer Area

Original Advisory
http://blog.hispasec.com/lab/advisories/adv_MagellanExplorer_3_32_Remote_Traversal.txt

Deep Links
Links available in Customer Area