This host is installed with WS_FTP professinal client and is prone to format string vulnerability.

Successful exploitation will allow attacker to execute arbitrary code in the context of the vulnerable application, failed exploit attempts will likely result in a denial-of-service condition.

Upgrade to WS_FTP Professional version 12.2, For updates refer to http://www.ipswitchft.com/Individual/Products/Ws_Ftp_Pro/

The flaw is due to error in 'formatted-printing()' function. It fails to properly sanitize user supplied input before passing it as the format specifier. Specifically, the issue presents itself when the client parses specially crafted responses for a malicious HTTP server.

WS_FTP Professional version prior to 12.2

• http://www.packetstormsecurity.org/0909-exploits/nocoolnameforawsftppoc.pl.txt
• http://xforce.iss.net/xforce/xfdb/53098

---

Updated on 2017-03-28