Fastream NETFile FTP/Web Server FTP Bounce Vulnerability

Bugtraq ID:	13653
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 17 2005 12:00AM
Updated:	May 17 2005 12:00AM
Credit:	Discovery is credited to Tan Chew Keong.
Vulnerable:	Fastream NetFILE FTP/Web Server 7.6 Fastream NetFILE FTP/Web Server 7.5 Beta 7 Fastream NetFILE FTP/Web Server 7.4.6 Fastream NetFILE FTP/Web Server 7.1
Not Vulnerable:

Fastream NETFile FTP/Web Server FTP Bounce Vulnerability

NETFile FTP/Web Server is affected by an FTP Bounce issue that can allow remote attackers to connect between the FTP server and an arbitrary port on another computer.

This could result in the proxying of arbitrary requests by a user through the system using the vulnerable FTP software.

This issue can allow attackers to bypass access controls and firewalls.

Fastream NETFile FTP/Web Server FTP Bounce Vulnerability

An exploit is not required.

Fastream NETFile FTP/Web Server FTP Bounce Vulnerability

Solution:
Reportedly, Fastream NETFile FTP/Web Server version 7.6 allows administrators to disable FXP support. If possible, users are advised to upgrade to this version and disable FXP support.

Fastream NETFile FTP/Web Server FTP Bounce Vulnerability

References:

• Fastream NETFile FTP/Web Server (Fastream)
  
• Fastream NETFile FTP/Web Server DoS Vulnerability (Tan Chew Keong)