Two vulnerabilities have been discovered in VicFTPS, which can be exploited by malicious users to cause a DoS (Denial of Service), disclose sensitive information, or potentially compromise a vulnerable system.

1) A NULL-pointer dereference error can be exploited to cause the service to crash via e.g. a specially crafted LIST command.

2) An input validation error can be exploited to download or replace arbitrary files placed outside the FTP root via specially crafted directory traversal sequences (e.g. ".../").

Successful exploitation of this vulnerability may allow execution of arbitrary code, but requires that uploads are enabled.

The vulnerabilities are confirmed in version 5.0. Other versions may also be affected.

Solution
Restrict access to the service.

Provided and/or discovered by
1) Neelima Premsankar
2) Christian Navarrete (chr1x) from the CubilFelino Security Research Lab

Changelog
Further details available in Customer Area

Original Advisory
2) http://chr1x.sectester.net/chr1xpwnadv-VicFTPSv5.0DirectoryTraversal.txt

Deep Links
Links available in Customer Area