Apple Mac OS X FTP Server (CVE-2011-0203) Directory Traversal Vulnerability

Bugtraq ID:	48418
Class:	Input Validation Error
CVE:	CVE-2011-0203
Remote:	Yes
Local:	No
Published:	Jun 23 2011 12:00AM
Updated:	Jun 23 2011 12:00AM
Credit:	Team karlkani.
Vulnerable:	Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac Os X Server 10.6.7 Apple Mac OS X Server 10.6
Not Vulnerable:	Apple Mac Os X Server 10.6.8

Apple Mac OS X FTP Server (CVE-2011-0203) Directory Traversal Vulnerability

Apple Mac OS X is prone to a directory-traversal vulnerability that exists in the FTP server component.

An attacker can exploit this issue to list files from directories outside of the FTP root directory. Successful exploits may lead to other attacks.

This issue affects Apple Mac OS X server 10.6 through 10.6.7.

NOTE: This issue was previously covered in BID 48412 (Apple Mac OS X Prior to 10.6.8 Multiple Security Vulnerabilities ) but has been assigned its own record to better document it.

Apple Mac OS X FTP Server (CVE-2011-0203) Directory Traversal Vulnerability

An attacker can exploit this issue using readily available tools.

Apple Mac OS X FTP Server (CVE-2011-0203) Directory Traversal Vulnerability

Solution:
Updates are available to address this issue. Please see the references for more information.


Apple Mac OS X Server 10.6.7

• Apple MacOSXServerUpd10.6.8.dmg
  For Mac OS X Server v10.6.7
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.1

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.3

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.5

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.6

• Apple MacOSXServerUpdCombo10.6.8.dmg
  For Mac OS X Server v10.6 - v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X FTP Server (CVE-2011-0203) Directory Traversal Vulnerability

References:

• Mac OS X Homepage (Apple)