Sysax Multi Server FTP 'DELE' Directory Traversal Vulnerability

Bugtraq ID:	34209
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 23 2009 12:00AM
Updated:	Mar 25 2009 04:46PM
Credit:	Jonathan Salwan
Vulnerable:	Codeorigin Sysax Multi Server 4.3
Not Vulnerable:

Sysax Multi Server FTP 'DELE' Directory Traversal Vulnerability

Sysax Multi Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow a remote attacker to access arbitrary files outside of the FTP server root directory. This can expose sensitive information that could help the attacker launch further attacks.

Sysax Multi Server 4.3 is vulnerable; other versions may also be affected.

Sysax Multi Server FTP 'DELE' Directory Traversal Vulnerability

The following exploit code is available:

• /data/vulnerabilities/exploits/34209.c

Sysax Multi Server FTP 'DELE' Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sysax Multi Server FTP 'DELE' Directory Traversal Vulnerability

References:

• Sysax Multi Server Homepage (Codeorigin)