Mirror File Creation Vulnerability
BID:681
Info
Mirror File Creation Vulnerability
| Bugtraq ID: | 681 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 28 1999 12:00AM |
| Updated: | Sep 28 1999 12:00AM |
| Credit: | This vulnerability was found by Wise Cat <[email protected]>. |
| Vulnerable: |
Lee McLoughlin Mirror 2.9 |
| Not Vulnerable: | |
Discussion
Mirror File Creation Vulnerability
A vulnerability in the Mirror Perl script allows remote FTP server operators to create or overwrite arbitrary files in the local system with the permission of the user running Mirror.
Mirror is a Perl script designed to duplicate a directory hierarchy between two machines via FTP. Lack of proper input validation on the part of Mirror allows malicious remote web sites to send it filenames formatted in such a way that force Mirror to create or overwrite arbitrary files on the system with the permissions of the user running the script. For example a malicous FTP server can send filenames with embedded ".." and '\' strings that will not be filtered by the script.
A vulnerability in the Mirror Perl script allows remote FTP server operators to create or overwrite arbitrary files in the local system with the permission of the user running Mirror.
Mirror is a Perl script designed to duplicate a directory hierarchy between two machines via FTP. Lack of proper input validation on the part of Mirror allows malicious remote web sites to send it filenames formatted in such a way that force Mirror to create or overwrite arbitrary files on the system with the permissions of the user running the script. For example a malicous FTP server can send filenames with embedded ".." and '\' strings that will not be filtered by the script.
Exploit / POC
Mirror File Creation Vulnerability
See discussion
See discussion