BisonFTP Server Directory Traversal Vulnerability

Bugtraq ID:	2695
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 17 2001 12:00AM
Updated:	Feb 17 2001 12:00AM
Credit:	Posted to Bugtraq by Tom Tom <[email protected]> on May 6, 2001 and discovered by t-Omicr0n <[email protected]> on Februrary 17, 2001.
Vulnerable:	BisonFTP Bison Ftp Server 4.0 R1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

BisonFTP Server Directory Traversal Vulnerability

A vulnerability exists in BisonFTP Server which allows a remote user to traverse the upper directories of a target host. This may lead to the disclosure of file and directory contents. Arbitrary directories can be accessed through the use of '/.../' techniques when using the 'cd' command.

BisonFTP Server Directory Traversal Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

BisonFTP Server Directory Traversal Vulnerability

Solution:
BisonFTP Support <[email protected]> has addressed this issue in Bison Ftp Server 4.0R1 Build 275.


BisonFTP Bison Ftp Server 4.0 R1

• BisonFTP BisonFTP41
  http://www.bisonftp.com/Files/BisonFTP41.exe

BisonFTP Server Directory Traversal Vulnerability

References:

• Bison Ftp Server Homepage (BisonFTP)