FFFTP 'LIST' Command Directory Traversal Vulnerability
BID:29459
Info
FFFTP 'LIST' Command Directory Traversal Vulnerability
| Bugtraq ID: | 29459 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-6424 |
| Remote: | Yes |
| Local: | No |
| Published: | May 31 2008 12:00AM |
| Updated: | Mar 13 2009 07:06PM |
| Credit: | Tan Chew Keong |
| Vulnerable: |
FFFTP FFFTP 1.96b |
| Not Vulnerable: | |
Discussion
FFFTP 'LIST' Command Directory Traversal Vulnerability
FFFTP is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue allows an attacker to write arbitrary files to locations outside of the FTP client's current directory. This could help the attacker launch further attacks.
The issue affects FFFTP 1.96b; other versions may also be vulnerable.
FFFTP is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.
Exploiting this issue allows an attacker to write arbitrary files to locations outside of the FTP client's current directory. This could help the attacker launch further attacks.
The issue affects FFFTP 1.96b; other versions may also be vulnerable.
Exploit / POC
FFFTP 'LIST' Command Directory Traversal Vulnerability
The researcher who discovered this issue has developed a working proof of concept, but it is not publicly available.
The researcher who discovered this issue has developed a working proof of concept, but it is not publicly available.
Solution / Fix
FFFTP 'LIST' Command Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
FFFTP 'LIST' Command Directory Traversal Vulnerability
References:
References:
- FFFTP FTP-Client Directory Traversal Vulnerability (Tan Chew Keong)
- FFFTP Homepage (FFFTP)