FireFTP Firefox Extension Double Quotes Security Bypass Vulnerability

Bugtraq ID:	36536
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 28 2009 12:00AM
Updated:	Sep 29 2009 04:10PM
Credit:	Tan Chew Keong
Vulnerable:	FireFTP FireFTP 1.0.5
Not Vulnerable:	FireFTP FireFTP 1.0.6

FireFTP Firefox Extension Double Quotes Security Bypass Vulnerability

The FireFTP extension for Firefox is prone to a security-bypass vulnerability.

Remote attackers can exploit this issue to bypass certain security restrictions and carry out unauthorized tasks.

This issue affects FireFTP 1.0.5. Other versions may also be vulnerable.

FireFTP Firefox Extension Double Quotes Security Bypass Vulnerability

An attacker may exploit this issue by enticing a user to send crafted requests through the affected application.

FireFTP Firefox Extension Double Quotes Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.


FireFTP FireFTP 1.0.5

• FireFTP fireftp-1.0.6-fx.xpi
  http://releases.mozilla.org/pub/mozilla.org/addons/684/fireftp-1.0.6-f x.xpi

FireFTP Firefox Extension Double Quotes Security Bypass Vulnerability

References:

• FireFTP for FireFox SFTP Command Manipulation Security Issue (vuln.sg)
  
• FireFTP Homepage (FireFTP)