BID:11589

ArGoSoft FTP Server Shortcut File Upload Vulnerability

Info

ArGoSoft FTP Server Shortcut File Upload Vulnerability

Bugtraq ID:	11589
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 02 2004 12:00AM
Updated:	Nov 02 2004 12:00AM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	ArGo Software Design FTP Server 1.4.2 .1 ArGo Software Design FTP Server 1.4.2 .0 ArGo Software Design FTP Server 1.4.1 .9 ArGo Software Design FTP Server 1.4.1 .8 ArGo Software Design FTP Server 1.4.1 .7 ArGo Software Design FTP Server 1.4.1 .6 ArGo Software Design FTP Server 1.4.1 .5 ArGo Software Design FTP Server 1.4.1 .4 ArGo Software Design FTP Server 1.4.1 .3 ArGo Software Design FTP Server 1.4.1 .2 ArGo Software Design FTP Server 1.4.1 .1 ArGo Software Design FTP Server 1.2.2 .2 - Microsoft Windows 2000 Advanced Server SP2 - Microsoft Windows 2000 Advanced Server SP1 - Microsoft Windows 2000 Advanced Server - Microsoft Windows 2000 Datacenter Server SP2 - Microsoft Windows 2000 Datacenter Server SP1 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Server SP2 - Microsoft Windows 2000 Server SP1 - Microsoft Windows 2000 Server - Microsoft Windows 2000 Terminal Services - Microsoft Windows 95 - Microsoft Windows 98 b - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 ArGo Software Design FTP Server 1.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0

Not Vulnerable:	ArGo Software Design FTP Server 1.4.2 .2

Discussion

ArGoSoft FTP Server Shortcut File Upload Vulnerability

ArGoSoft FTP server is reported prone to a vulnerability that allows users to upload shortcut (.lnk) files to the server. Further details were not provided about this issue.

It is conjectured that this issue is related to BID 2961 (ArGoSoft FTP Server .lnk Directory Traversal Vulnerability), which allows users with write permission to any directory to create and upload a .lnk file that points to the directory of their choice. They will then have read and write access to that directory and any files therein.

ArGoSoft FTP server 1.4.2.1 and prior versions are reportedly affected by this issue.

Exploit / POC

ArGoSoft FTP Server Shortcut File Upload Vulnerability

An exploit is not required to exploit this issue.

Solution / Fix

ArGoSoft FTP Server Shortcut File Upload Vulnerability

Solution:
The vendor has released ArGoSoft FTP Server version 1.4.2.2 to address this issue.

ArGo Software Design FTP Server 1.0