CompleteFTP Server is a high-performance Windows FTP server supporting FTP, FTPS, SFTP and SCP. It features both Windows and non-Windows users and a fully configurable virtual file-system.
Sow Ching Shiong, an independent vulnerability researcher has identified a Directory Traversal vulnerability in CompleteFTP Server. This issue was discovered in a default installation of CompleteFTP Server 4.0.2. Other earlier versions may also be affected.
Proof of concept
Update to version 4.0.3 or later.
Vendor URL: http://www.enterprisedt.com/products/completeftp/history.html
2010-05-18 - Vulnerability discovered.
2010-05-18 - Vulnerability reported to Secunia.
2010-05-19 - Secunia confirmed the vulnerability and contacted the vendor.
2010-06-02 - Patch released.
2010-06-02 - Advisory published by Secunia.