| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Epson L3060 Adjustment Program Communication Error Exclusive -This error appears when the program cannot establish a stable link between your computer and the printer. It’s infuriating because the printer works fine for regular printing, but the service tool refuses to connect. This article is designed to be a definitive troubleshooting guide, targeting users who encounter this specific error when trying to use the proprietary Epson Adjustment Program. If you own an Epson L3060 (a popular multi-function ink tank printer), you might have reached a point where a simple reset or maintenance task is required. To perform a waste ink pad counter reset, ink charge, or head cleaning, you need the Epson L3060 Adjustment Program . epson l3060 adjustment program communication error exclusive However, a frustrating roadblock awaits many users: This error appears when the program cannot establish Disclaimer: Adjustment programs are for authorized service centers. Using them may void your warranty. Proceed at your own risk. If you own an Epson L3060 (a popular However, you can still reset the waste ink counter without the Epson program using (Waste Ink Counter Reset). This third-party tool uses a different communication protocol and often works when the Epson Adjustment Program fails.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |