Secunia

Multiple vulnerabilities has been identified in Power Server allowing FTP users to retrieve other users passwords and a Denial of Service.

1) The web server can't handle "GET" requests with more than 500,000 times "/". This causes the service to consume large amounts of CPU power.

2) It is possible to cause the FTP service to consume large amounts of CPU power by supplying 50,000 characters to one of the following arguments: USER, PASS, CWD, LS, MKDIR

3) All passwords and usernames for the FTP service are stored in plain text.

4) Trivial directory traversal is possible, using "ls c:/" and "get c:/path_to_users/username.ini". This allows FTP users to access any user profile or file.

Solution
Disable the FTP service.
Further details available in Customer Area

Provided and/or discovered by
Ziv Kamir

Deep Links
Links available in Customer Area