FireFTP 'MLSD' And 'LIST' Commands Directory Traversal Vulnerability

Bugtraq ID:	29289
Class:	Input Validation Error
CVE:	CVE-2008-2399
Remote:	Yes
Local:	No
Published:	May 19 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Tan Chew Keong
Vulnerable:	FireFTP FireFTP 0.97.1
Not Vulnerable:	FireFTP FireFTP 0.98.20080518

FireFTP 'MLSD' And 'LIST' Commands Directory Traversal Vulnerability

FireFTP is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the FTP client's current directory. This could help the attacker launch further attacks.

FireFTP 0.97.1 is vulnerable; other versions may also be affected.

FireFTP 'MLSD' And 'LIST' Commands Directory Traversal Vulnerability

A researcher has developed and published a working prrof of concept. The exploit was removed from the website but it may still be publically available.

FireFTP 'MLSD' And 'LIST' Commands Directory Traversal Vulnerability

Solution:
The vendor has fixed the issue in the CVS repository. Please see the references for more information.

FireFTP 'MLSD' And 'LIST' Commands Directory Traversal Vulnerability

References:

• Changelog: fix security vulnerability with not scrubbing '..' out of FTP listing (FireFTP)
  
• FireFTP add-on for FireFox Directory Traversal Vulnerability (Tan Chew Keong)
  
• FireFTP Homepage (FireFTP)
  
• Vulnerability Note VU#906907 FireFTP filename directory traversal sequence vulne (US-CERT)