Titan FTP Server 'xcrc' Command Arbitrary File Disclosure Vulnerability

Bugtraq ID:	40904
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 15 2010 12:00AM
Updated:	Jun 15 2010 12:00AM
Credit:	Bill Finlayson
Vulnerable:	Southrivertech Titan FTP Server 8.10.1125 Southrivertech Titan FTP Server 3.30 Southrivertech Titan FTP Server 3.21 Southrivertech Titan FTP Server 3.10 Southrivertech Titan FTP Server 3.0 1 Southrivertech Titan FTP Server 2.10 Southrivertech Titan FTP Server 2.2 Southrivertech Titan FTP Server 6.26 build 630 Southrivertech Titan FTP Server 6.05 build 550
Not Vulnerable:

Titan FTP Server 'xcrc' Command Arbitrary File Disclosure Vulnerability

Titan FTP Server is prone to an arbitrary-file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view local files in the context of the webserver process, which may aid in further attacks.

Titan FTP Server 8.10.1125 is vulnerable; other versions may also be affected.

Titan FTP Server 'xcrc' Command Arbitrary File Disclosure Vulnerability

Attackers can exploit this issue via a browser.

Titan FTP Server 'xcrc' Command Arbitrary File Disclosure Vulnerability

Solution:
Reportedly this issue has been fixed. Contact the vendor for more information.

Titan FTP Server 'xcrc' Command Arbitrary File Disclosure Vulnerability

References:

• Titan FTP Server Homepage (South River Technologies)
  
• TitanFTP Server Arbitrary File Disclosure ([email protected])