Luigi Auriemma has discovered a security issue in IPSwitch WS_FTP Server, which can be exploited by malicious people to bypass certain access restrictions and disclose sensitive information.

The security issue is caused due to an error within the WS_FTP Server Manager when processing HTTP requests for the FTPLogServer/LogViewer.asp script. This can be exploited to gain access to the log viewing interface by e.g. logging out and directly accessing the FTPLogServer/LogViewer.asp script.

The security issue is confirmed in WS_FTP Server Manager included in WS_FTP Server version 6.1. Other versions may also be affected.

Solution
Update to version 6.1.1.

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available in Customer Area

Original Advisory
Ipswitch:
http://docs.ipswitch.com/WS_FTP_Server611/ReleaseNotes/index.htm?k_id=ipswitch_ftp_documents_worldwide_ws_ftpserverv611releasenotes#link12

Luigi Auriemma:
http://aluigi.altervista.org/adv/wsftpweblog-adv.txt

Deep Links
Links available in Customer Area