Gene6 BPFTP Server File Existence Disclosure Vulnerability

Bugtraq ID:	2537
Class:	Access Validation Error
CVE:	CVE-2001-0263
Remote:	Yes
Local:	No
Published:	Apr 03 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	Discovered by Rob Beck [[email protected]] on April 3, 2001.
Vulnerable:	Gene6 G6 FTP Server 2.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:	Gene6 BPFTP Server 2.10 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0

Gene6 BPFTP Server File Existence Disclosure Vulnerability

A user can confirm the existence and location of files and directory structure information, by submitting a 'size' or 'mdtm' command of a file. If the command is carried out by the vulnerable service, the attacker can confirm the location of the file.

Submitting a 'size' or 'mdtm' command for a file outside of the FTP root could disclose directory structure information of unpublished filesystems on the host. If the requested command is fulfilled by the vulnerable service, the attacker can confirm the relative path to the file.

Either request is achievable even if the 'show relative paths' option is not enabled.

Gene6 BPFTP Server File Existence Disclosure Vulnerability

The following exploit has been provided by Rob Beck [[email protected]]:

• /data/vulnerabilities/exploits/g6-find.pl

Gene6 BPFTP Server File Existence Disclosure Vulnerability

Solution:
Gene6 has addressed this issue in BPFTP Server v2.10:


Gene6 G6 FTP Server 2.0

• Gene6 postdown
  http://www.bpftpserver.com/postdown.html