Junkie FTP Client Server Response Download Filename Command Execution Vulnerability

Bugtraq ID:	11978
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 15 2004 12:00AM
Updated:	Dec 15 2004 12:00AM
Credit:	Yosef Klein is credited with the discovery of this issue.
Vulnerable:	junkie FTP Client 0.3.1
Not Vulnerable:

Junkie FTP Client Server Response Download Filename Command Execution Vulnerability

A remote command execution vulnerability reportedly affects junkie FTP client. This issue is due to a failure of the application to sanitize network derived input prior to using it in a using it in a system() command.

An attacker may leverage this issue to execute arbitrary commands with the privileges of the unsuspecting user that activated the affected application. This may facilitate unauthorized access and privilege escalation.

Junkie FTP Client Server Response Download Filename Command Execution Vulnerability

No exploit is required to leverage this issue.

Junkie FTP Client Server Response Download Filename Command Execution Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]&rt;.

Junkie FTP Client Server Response Download Filename Command Execution Vulnerability

References:

• [remote] [control] junkie 0.3.1 gui_popup_view_fly does not check for nasty char ("D. J. Bernstein" )
  
• junkie FTP Client Home Page (junkie)