Acritum Femitter Server Information Disclosure and Denial of Service Vulnerabilities

Bugtraq ID:	31226
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 17 2008 12:00AM
Updated:	Sep 18 2008 02:30PM
Credit:	LiquidWorm
Vulnerable:	Acritum Femitter Server 1.03
Not Vulnerable:

Acritum Femitter Server Information Disclosure and Denial of Service Vulnerabilities

Acritum Femitter Server is prone to an information-disclosure vulnerability and a denial-of-service vulnerability.

Successfully exploiting these issues may allow an attacker to obtain sensitive information or cause the affected application to crash, denying service to legitimate users.

Femitter Server 1.03 is vulnerable; other versions may also be affected.

Acritum Femitter Server Information Disclosure and Denial of Service Vulnerabilities

Attackers can exploit these issues by using readily available network utilities.

The following example URIs are available:

ftp://www.example.com/\..
ftp://www.example.com/\..\/\..\

Acritum Femitter Server Information Disclosure and Denial of Service Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Acritum Femitter Server Information Disclosure and Denial of Service Vulnerabilities

References:

• Acritum Femitter Server Product Page (Acritum)