CesarFTP Directory Traversal Vulnerability

Bugtraq ID:	2786
Class:	Input Validation Error
CVE:	CVE-2001-1335
Remote:	Yes
Local:	No
Published:	May 27 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	This vulnerability was posted to BugTraq on May 27th, 2001 by ByteRage <[email protected]>.
Vulnerable:	ACLogic CesarFTP 0.98 b - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 j - Microsoft Windows 95 Build 490.R6 - Microsoft Windows 95 - Microsoft Windows 98 j - Microsoft Windows 98 b - Microsoft Windows 98 a - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows ME - Microsoft Windows NT 3.5.1 SP5 - Microsoft Windows NT 3.5.1 SP4 - Microsoft Windows NT 3.5.1 SP3 - Microsoft Windows NT 3.5.1 SP2 - Microsoft Windows NT 3.5.1 SP1 - Microsoft Windows NT 3.5.1 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 3.5
Not Vulnerable:

CesarFTP Directory Traversal Vulnerability

CesarFTP is a freely available FTP Server for Microsoft Windows 9x/ME systems.

CesarFTP on Windows 98/Me platforms contains a 'directory traversal' vulnerability.

If a user requests to change directories to "..." from within a mapped directory, they will change into the directory above the 'real' directory on the filesystem. At this point they can traverse the filesystem and will have read access to almost every file.

A user must already have an account on the server to take advantage of this vulnerability.

Note: This vulnerability only affects Windows 98/Me systems running CesarFTP.

CesarFTP Directory Traversal Vulnerability

Solution:
The vendor has been notified, but as of yet has not responded with news of any pending patches or fixes.

Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.