Just a day after version 3.1.0 release, Filezilla 3.1.0.1 fixes an important security vulnerability.

FileZilla 3.1.0.1 fixes a vulnerability regarding the way some errors are handled on SSL/TLS secured data transfers.

If the data connection of a transfer gets closed, FileZilla did not check if the server performed an orderly TLS shutdown.
Impact

An attacker could send spoofed FIN packets to the client. Even though GnuTLS detects this with GNUTLS_E_UNEXPECTED_PACKET_LENGTH, FileZilla did not record a transfer failure in all cases.

Unfortunately not all servers perform an orderly SSL/TLS shutdown. Since this cannot be distinguished from an attack, FileZilla will not be able to download listings or files from such servers.

Latest changes:

• Fix infinite loop in new socket class
• Fix file descriptor/handle leak in new socket class
• Fix locking error if cancelling an operation waiting for a lock held by a different engine
• MSW: In rare cases, initial read event was not triggered on transfer sockets
• Add missing icon in LonE theme

Website Download Client | Server

• FileZilla 3.0.11
• FileZilla 3.1.5
• FileZilla 3.1.3
• FileZilla 3.1.5.1
• FileZilla 3.1.4.1