WS_FTP 2007 Professional SCP handling format string vulnerability
Synopsis: WS_FTP 2007 Professional SCP handling format string vulnerability
Product: WS_FTP 2007 Professional
Vendor: Ipswitch
I. Background
"[..]Transfer files anywhere, anytime, with complete security.
* Lightning fast transfer speeds
* Industry leading security
* Time saving features include schedule, backup, and email
notifications[..]"
II. Problem Description
Remote code execution is possible.
III. Details
SCP handling module is vulnerable to format string vulnerability.
Opening a specially crafted SCP file with WS_FTP 2007 script handler
might lead to arbitrary code execution. The specially crafted file
uses the WS_FTP script command "SHELL" and executes the file with
the specially crafted name. The file is access using "file://".
Kind regards,
Michal Bucko (sapheal)