DiddyFtpServer Directory Traversal Vulnerability

Bugtraq ID:	46555
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 24 2011 12:00AM
Updated:	Mar 07 2011 07:07PM
Credit:	R3d@l3rt, Sp@2K, Sunlight
Vulnerable:	Rolf Büchi myDB Lite 1.1.10 Laan Labs Share 1.0 DiddySoft DiddyFtpServer 0 DiddySoft DiddyDJ 0 Dan Leehr Filer Lite 2.1.0 CRS Diogenes iDocManager 1.0.0 Air Files Air Files 2.6
Not Vulnerable:

DiddyFtpServer Directory Traversal Vulnerability

DiddyFtpServer is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to download or upload arbitrary files outside of the FTP server root directory; this may aid in further attacks.

DiddyFtpServer Directory Traversal Vulnerability

Attackers can use readily available tools and commands to exploit this issue.

DiddyFtpServer Directory Traversal Vulnerability

Solution:
Updates are available. Please contact the vendor for more information.

DiddyFtpServer Directory Traversal Vulnerability

References:

• Air Files Homepage (Air Files )
  
• Diddy DJ (DiddySoft)
  
• DiddyFtpServer (DiddySoft)
  
• Filer Lite (Dan Leehr)
  
• iDocManager (CRS Diogenes)
  
• myDB Lite (Rolf Büchi)
  
• Share (Laan Labs)
  
• Vendor Homepage (DiddySoft)