| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Epson Scan 2 Silent Install Extra Quality ((install)) (2024)Epson Scan 2 stores settings in the registry and local AppData. For a high-quality "golden image" deployment, you can export the HKEY_CURRENT_USER\Software\EPSON\Epson Scan 2 registry key from a configured machine and import it via script during the silent install. To perform a silent installation of while ensuring "extra quality" (high-performance drivers and optimal scan settings), you can use specific command-line parameters or extraction methods. Silent Installation Methods Save this file in the same directory as the Epson Scan 2 executable. Use the /l*v switch to generate logs for troubleshooting: setup.exe /s /v"/qn /l*v C:\Windows\Temp\EpsonScan2.log" epson scan 2 silent install extra quality : Prevents the workstation from unexpectedly restarting mid-deployment. Method B: Direct MSI Deployment (For SCCM/Intune) Or use a tool like 7-Zip to extract the .msi and .cab files. REM Paths set INSTALLER=C:\installers\EpsonScan2.exe set LOG=C:\installers\epson_install.log Epson Scan 2 stores settings in the registry Apply via .reg file: /norestart : Ensures the system remains online immediately following the asset push. Step 4: Configuring "Extra Quality" Settings No need to walk users through changing settings from 200 DPI to 600 DPI. Silent Installation Methods Save this file in the Here’s a for a silent installation of Epson Scan 2 with an emphasis on obtaining the best possible image quality settings post-install (since “extra quality” is a configuration/output setting, not an installer flag). Executing via the setup wrapper ensures that all prerequisite components, plug-ins, and USB drivers are installed in the correct order. Setup.exe /s /v"/qn REBOOT=ReallySuppress" Use code with caution. /s : Instructs the main setup wrapper to run silently.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |