CVE-2005-2126

An attacker hosts a file on an FTP server with a specially-crafted file name designed to bypass the FTP client's file name validation. The file name is constructed so that it maps to a valid location on the user's computer, such as writing an executable to the Startup folder [ref_id=1]. The attacker must then persuade the user to visit the FTP server and manually initiate a file transfer while "Enable Folder View for FTP Sites" is enabled. User interaction is required — the attacker cannot force the file transfer automatically [ref_id=1].

The vulnerability resides in the Windows FTP client component, which is part of the operating system on Windows XP SP1 and Windows Server 2003, and in Internet Explorer 6 SP1 on Windows 2000 SP4. The advisory states that "the Windows FTP client does not properly validate file names that are received from FTP servers" [ref_id=1]. No specific function or file names are identified in the bulletin.

The security update "removes the vulnerability by modifying the way the Windows FTP client validates file names that it receives from FTP servers" [ref_id=1]. No patch diff is included in the bundle, so the exact code changes are not visible. The advisory does not specify the precise validation logic that was added or changed.