Jigunet TwinFTP Server Directory Traversal Vulnerability

Bugtraq ID:	11159
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 13 2004 12:00AM
Updated:	Sep 13 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Tan Chew Keong of SIG^2.
Vulnerable:	Jigunet TwinFTP Standard 1.0.3 R2 Jigunet TwinFTP Enterprise 1.0.3 R2
Not Vulnerable:

Jigunet TwinFTP Server Directory Traversal Vulnerability

It is reported that TwinFTP Server is susceptible to a directory traversal vulnerability.

This vulnerability presents itself when certain arguments for FTP commands passed to the FTP server contain '../' directory traversal characters.

This vulnerability allows a remote attacker to read and write files outside of the FTP document root directory.

Jigunet TwinFTP Server Directory Traversal Vulnerability

There is no exploit required.

Jigunet TwinFTP Server Directory Traversal Vulnerability

Solution:
It is reported that the vendor has addressed this vulnerability in TwinFTP Server Standard and Enterprise Version 1.0.3 R3. Customers are advised to contact the vendor for further details regarding obtaining and applying appropriate updates.

Jigunet TwinFTP Server Directory Traversal Vulnerability

References:

• Directory Traversal Vulnerability in TwinFTP Server allows overwriting of files (SIG^2 Vulnerability Research)
  
• TwinFTP Homepage (Jigunet)
  
• Directory Traversal Vulnerability in TwinFTP Server allows overwriting ("Jérôme" ATHIAS )