WinSCP URI Handler Remote Arbitrary File Access Vulnerability

Bugtraq ID:	18384
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 12 2006 12:00AM
Updated:	Jun 12 2006 10:56PM
Credit:	Jelmer Kuperus is credited with the discovery of this vulnerability.
Vulnerable:	WinSCP WinSCP 3.8.1
Not Vulnerable:

WinSCP URI Handler Remote Arbitrary File Access Vulnerability

WinSCP is prone to an arbitrary file-access vulnerability.

An attacker can exploit this issue to upload arbitrary files to a victim user's computer or to download arbitrary files from the victim's computer in the context of the vulnerable application.

This issue affects version 3.8.1; earlier versions may also be vulnerable.

WinSCP URI Handler Remote Arbitrary File Access Vulnerability

An attacker can exploit this issue by creating a malicious URI consisting if 'scp://' or 'sftp://' URI handlers.

The following proof-of-concept URIs are available:

• /data/vulnerabilities/exploits/WinSCP-0912-afa.txt

WinSCP URI Handler Remote Arbitrary File Access Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

WinSCP URI Handler Remote Arbitrary File Access Vulnerability

References:

• WinSCP Product Page (WinSCP)