| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Izotope Ozone 5 Advanced V505b Macosx K 39d Hot Jun 2026The update was crucial for stability and performance on macOS. As Apple transitioned through different OS iterations, legacy audio software often required patches to remain efficient. The v5.05b update brought: You cannot run Ozone 5 Advanced natively on macOS Catalina or later because Apple dropped 32-bit support. Workarounds: izotope ozone 5 advanced v505b macosx k 39d hot Before you start tweaking, use the Meter Bridge to analyze your audio. Check your stereo balance, phase coherence, and spectral content. The update was crucial for stability and performance Maximizer: The IRC III (Intelligent Release Control) technology helped achieve competitive loudness while maintaining transient clarity. Why the v5.05b Release? Workarounds: Before you start tweaking, use the Meter Modern versions use advanced machine learning algorithms to analyze your stereo file and automatically build a custom, genre-specific starting chain in seconds. The designation distinguishes it from the standard version by offering individual component plugins. This means you can use the Ozone Equalizer or Maximizer on individual tracks in your mix, rather than just on the master bus, significantly increasing the tool's versatility. Key Modules in Ozone 5 Advanced
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |