Secunia

n.runs AG has reported a security issue in JSCAPE Secure FTP Applet, which can be exploited by malicious people to conduct spoofing attacks.

The problem is that the certificate presented by a server at the beginning of a secure session is not verified. This can be exploited to spoof valid servers via a man-in-the-middle attack.

The security issue is reported in versions prior to 4.9.0.

Solution
Update to version 4.9.0.

Provided and/or discovered by
Frank Dick and Thierry Zoller, n.runs AG

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2008-June/062931.html

Deep Links
Links available in Customer Area