A security issue has been reported in Bftpd, which can be exploited by malicious people to compromise a vulnerable system.

The security issue is caused due to the server failing to restrict the anonymous account to the directory specified by the "ROOTDIR" configuration option. This can be exploited to gain read and write access to arbitrary files or directories on an affected system.

Successful exploitation requires that the anonymous account is enabled (disabled by default).

The security issue is reported in versions prior to 2.9.

Solution
Update to version 2.9.

Provided and/or discovered by
The vendor credits Paul Laufer.

Original Advisory
http://bftpd.sourceforge.net/news.html

Deep Links
Links available in Customer Area