Home FTP Server Directory Traversal Vulnerability

Bugtraq ID:	40419
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 27 2010 12:00AM
Updated:	Nov 01 2010 09:18AM
Credit:	John Leitch
Vulnerable:	Home Ftp Server Home Ftp Server 1.11.1.149 Home Ftp Server Home Ftp Server 1.10.2.143
Not Vulnerable:

Home FTP Server Directory Traversal Vulnerability

Home FTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to download, upload, and delete arbitrary files outside of the FTP server's root directory. This may aid in further attacks.

Home FTP Server 1.10.2.143 and 1.11.1.149 are vulnerable; other versions may also be affected.

Home FTP Server Directory Traversal Vulnerability

Attackers can use readily available tools and commands to exploit this issue.

The following exploit codes are available:

• /data/vulnerabilities/exploits/40419.py
• /data/vulnerabilities/exploits/40419.txt

Home FTP Server Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Home FTP Server Directory Traversal Vulnerability

References:

• Home Ftp Server Product Page (Home Ftp Server)