Pablo Software Solutions FTP Server File/Directory Disclosure Vulnerability

Bugtraq ID:	5283
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 22 2002 12:00AM
Updated:	Jul 22 2002 12:00AM
Credit:	Discovery of this issue is credited to Arnaud Jacques.
Vulnerable:	Pablo Software Solutions FTP Service 1.0 - Microsoft Windows 98 - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP6 - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home
Not Vulnerable:

Pablo Software Solutions FTP Server File/Directory Disclosure Vulnerability

Pablo Software Solutions FTP Server is prone to directory traversal attacks. An attacker may exploit this condition to escape the FTP root directory and browse the contents of arbitrary directories and files (provided they are readable by the FTP server).

Since the software typically runs with SYSTEM privileges (or the equivalent of SYSTEM privileges on Microsoft Windows 9x), this vulnerability may expose sensitive system files to remote attackers.

Pablo Software Solutions FTP Server File/Directory Disclosure Vulnerability

This issue may be exploited with a web browser.

Pablo Software Solutions FTP Server File/Directory Disclosure Vulnerability

Solution:
This issue has been addressed in Pablo Software Solutions FTP Server Version 1.0 Build 010 and later. Those affected by this vulnerability are advised to upgrade.

Pablo Software Solutions FTP Server File/Directory Disclosure Vulnerability

References:

• FTP Service Homepage (Pablo Software Solutions)