| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Galletto 1260 Drivers Windows 10 Fixed -You should see: "Interface found. Protocol Ok." Download a specialized EEPROM editing utility like or FT_Prog from the FTDI Utilities Portal. Run the application as an Administrator. By following these solutions and recommendations, users should be able to resolve the issue with installing Galetto 1260 drivers on Windows 10. : The older hardware standard used in these cables often fails when plugged into modern blue USB 3.0 or Type-C ports. The Ultimate Fix: Step-by-Step Windows 10 Guide galletto 1260 drivers windows 10 fixed Disclaimer: Modifying vehicle ECU software carries risks. Ensure you have a backup of your original file. The authors are not responsible for bricked ECUs. I can provide specific troubleshooting steps or help you find the correct hardware IDs. Share public link On the next screen, press or F7 on your keyboard to choose "Disable driver signature enforcement" . Your computer will restart normally. 3. Install the Drivers Plug your Galletto 1260 cable into a USB port. Right-click the Start Menu and select Device Manager . You should see: "Interface found Your computer will now boot normally, allowing you to install unsigned drivers. Part 3: Install the Drivers Manually Plug in your Galletto 1260 cable. Right-click the and select Device Manager . Getting the Galletto 1260 to work on Windows 10 is almost always a driver signing issue. By disabling driver signature enforcement and installing the correct, older FTDI drivers, you can fix the issue and begin using the tool for your tuning projects. After installation, the device appears as under Ports (COM & LPT) . Ensure you have a backup of your original file Lower the from the default 16 down to 1 . This prevents timeout errors while reading the ECU. Most Galletto 1260 drivers were developed years ago, and the software lacks this modern digital signature. Consequently, when you plug the cable in, Windows 10 will block the driver installation with an error, leaving your Galletto 1260 as a non-functional "Unknown Device" in the Device Manager.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |