Smallftpd Discloses Files on the System to Remote Users
|
|
SecurityTracker Alert ID: 1006685 |
|
SecurityTracker URL: http://securitytracker.com/id/1006685
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 30 2003
|
Impact:
Denial of service via network, Disclosure of system information, Disclosure of user information
|
Exploit Included: Yes
|
Version(s): 1.0.2 and prior versions
|
Description:
A vulnerability was reported in Smallftpd. A remote user can view files on the server that are located outside of the FTP root directory.
It is reported that a remote authenticated user, including an anonymous user, can generate a CWD command with directory traversal characters ".." to view files located outside of the FTP document directory.
A demonstration exploit is provided:
CWD \..\..
It is also reported that version 0.99 allows remote users to send "%s %s" as the login name to cause the FTP service to crash. A remote authenticated user can also trigger a buffer overflow by issuing a command with more than 280 characters, cauing the service to crash.
|
Impact:
A remote authenticated user (including an anonymous users) can view files on the system that are located outside of the FTP document directory.
On previous versions (0.99), a remote authenticated user can cause the system to crash.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: smallftpd.free.fr/ (Links to External Site)
|
Cause:
Boundary error, Input validation error
|
Underlying OS:
Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 30 Apr 2003 12:05:27 +0200
Subject: smallftpd's version 1.0.2 Directory Transversal Vulnerability
|
Smallftpd is a simple and small Ftp server for windows. A vulnerability
exists in smallftpd v 1.02(http://smallftpd.free.fr/) that allow
unauthorizeded users to browse the root directorys and skip access list.
CWD \..\..
250 CWD command successful.
also smallftpd v0.99 avaliable to download at http://smallftpd.free.fr too
have multiple vulnerabilities.
Denial OF service: just type "%s %s" as login and the ftp server will crash.
buffer overflows when a command have length >280 chars. example: cd
AAAAAAAAAA...
this bugs seems to be patched in the lastest version.
at4r [at] 3wdesign.es Security 2003
_________________________________________________________________
Melodías, logos y mil servicios para tu teléfono en MSN Móviles.
http://www.msn.es/MSNMovil/
|
|
