ArGoSoft FTP Server .NET Directory Traversal Vulnerability

Bugtraq ID:	38756
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 15 2010 12:00AM
Updated:	Mar 15 2010 12:00AM
Credit:	dmnt
Vulnerable:	ArGo Software Design ArGoSoft FTP Server .NET 1.0.2.1 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0
Not Vulnerable:

ArGoSoft FTP Server .NET Directory Traversal Vulnerability

ArGoSoft FTP Server .NET is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to upload and download arbitrary files outside of the FTP server root directory. This could help the attacker launch further attacks.

ArGoSoft FTP Server .NET 1.0.2.1 is vulnerable; other versions may also be affected.

ArGoSoft FTP Server .NET Directory Traversal Vulnerability

Attackers can use readily available tools and commands to exploit this issue.

ArGoSoft FTP Server .NET Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ArGoSoft FTP Server .NET Directory Traversal Vulnerability

References:

• ArGoSoft FTP Server .NET Homepage (ArGo Software Design)