A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.

This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.

The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command.

Response to LIST (forward-slash):

-rw-r--r--    1 ftp      ftp            20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n

By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.

Oracle Developer Suite 10g Download [upd] 〈100% PRO〉

Q: What are the system requirements for Oracle Developer Suite 10g? A: The system requirements for Oracle Developer Suite 10g include Windows NT 4.0 SP6 or later, Windows 2000 SP2 or later, or Linux, Intel Pentium III or equivalent, 512 MB RAM or more, and 2 GB or more disk space.

Q: What is the difference between Oracle Developer Suite 10g and Oracle Fusion Middleware? A: Oracle Developer Suite 10g is a comprehensive set of tools for developing, deploying, and managing enterprise applications, while Oracle Fusion Middleware is a more comprehensive platform for building and deploying enterprise applications. oracle developer suite 10g download

Q: Can I install Oracle Developer Suite 10g on a 64-bit system? A: Yes, Oracle Developer Suite 10g can be installed on a 64-bit system, but you may need to configure the installation process to use the 32-bit version of the software. Q: What are the system requirements for Oracle

2008-06-15 - Vulnerability Discovered.
2008-06-16 - Vulnerability Details Sent to Vendor via online support form (no reply).
2008-06-18 - Vulnerability Details Sent to Vendor again via online support form (no reply).
2008-06-25 - Vulnerability Details Sent to Vendor again via online support form (no reply).
2008-06-27 - Public Release.