Two vulnerabilities have been discovered in CompleteFTP, which can be exploited by malicious users to bypass certain security restrictions and compromise a vulnerable system.

1) An input validation error in the FTP service can be exploited to download or replace arbitrary files placed in a directory above the FTP root by prepending a ".../" sequence to the filename.

2) An input validation error in the FTP service allows to change the current working directory to an arbitrary directory on the filesystem by specifying an absolute path. This can be exploited to download or replace arbitrary files in arbitrary directories on the local file system.

The vulnerabilities are confirmed in version 4.0.2. Prior versions may also be affected.

Solution
Update to version 4.0.3.

Provided and/or discovered by
Reported by Sow Ching Shiong via Secunia.

Original Advisory
Enterprise Distributed Technologies:
http://www.enterprisedt.com/products/completeftp/history.html

Deep Links
Links available to Secunia VIM customers