by Tan Chew Keong
Release Date: 2008-06-27
[en] [jp]
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command.
An example of such a response from a malicious FTP server is shown below.
Response to LIST (forward-slash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n
By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below.
Fake-webcam-7-7.0.1.23
is a powerful software application that allows users to stream pre-recorded videos, photos, and effects to video chat platforms as if they were a live webcam feed. This virtual webcam tool tricks video broadcasting applications into recognizing the software as a physical hardware camera, opening up endless possibilities for content creators, privacy-conscious users, and remote workers alike.
: It allows users to protect their actual surroundings or identity by substituting live video with chosen media. Room for Improvement
: Open the application interface. Click "Add Video" or "Add Image" to import your chosen media file into the playback queue. fake-webcam-7-7.0.1.23
: This specific build (7.0.1.23) focuses on fixing minor lag issues and improving compatibility with the latest versions of Windows. Why Use It?
The virtual driver is built to work across different platforms. It integrates smoothly with communication apps, streaming tools (like OBS Studio), and web-based WebRTC applications inside Google Chrome or Microsoft Edge. Practical Use Cases is a powerful software application that allows users
Before installing Fake Webcam 7.0.1.23, ensure your system meets the necessary requirements for stable virtual video rendering: Requirement
Play funny clips, animated GIFs, or looped videos to friends during casual video calls. Room for Improvement
: Open the application interface
The installation file for most fake webcam software is relatively small, typically around 3.3 to 7.7 MB. After downloading the installer from a trusted source, run the executable file and follow the on-screen instructions. Some versions may be available as trial downloads from the publisher's official website.
Patch / Workaround
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered.
2008-06-16 - Vulnerability Details Sent to Vendor via online support form (no reply).
2008-06-18 - Vulnerability Details Sent to Vendor again via online support form (no reply).
2008-06-25 - Vulnerability Details Sent to Vendor again via online support form (no reply).
2008-06-27 - Public Release.