Secunia

Two vulnerabilities have been identified in Baby FTP Server, which can be exploited to cause a DoS (Denial of Service) or traverse directories.

Due to an input validation error in the command "CWD", it is possible for a malicious user to traverse directories by supplying various character sequences (eg. "..." or "/...").

It is also possible for a malicious person to cause a DoS (Denial of Service) on a vulnerable FTP server by establishing multiple connections to it (app. 100 connections) from the same IP address.

The vulnerabilities have been reported in version 1.2. However, prior versions may also be affected.

Solution
Update to version 1.21:
Further details available in Customer Area

Provided and/or discovered by
dr_insane

Original Advisory
http://packetstormsecurity.nl/0305-exploits/baby.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area