Archimede's Glftpd File Modification Vulnerability
BID:6908
Info
Archimede's Glftpd File Modification Vulnerability
| Bugtraq ID: | 6908 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 21 2003 12:00AM |
| Updated: | Feb 21 2003 12:00AM |
| Credit: | The discovery of this vulnerability has been credited to Karol Wiêsek. |
| Vulnerable: |
Archimede's Glftpd Glftpd 1.28 Archimede's Glftpd Glftpd 1.27 Archimede's Glftpd Glftpd 1.26 Archimede's Glftpd Glftpd 1.25 |
| Not Vulnerable: | |
Discussion
Archimede's Glftpd File Modification Vulnerability
A vulnerabilty has been discovered in Archimede's glftpd which may allow an unauthorized user to overwrite sensitive data.
It is possible for an attacker to overwrite sensitive FTP files by sending messages to maliciously constructed usernames. Files influenced by this issue would be limited to those contained within the chrooted environment. By exploiting this issue an attacker would be able to overwrite an arbitrary file with formatted message text.
A vulnerabilty has been discovered in Archimede's glftpd which may allow an unauthorized user to overwrite sensitive data.
It is possible for an attacker to overwrite sensitive FTP files by sending messages to maliciously constructed usernames. Files influenced by this issue would be limited to those contained within the chrooted environment. By exploiting this issue an attacker would be able to overwrite an arbitrary file with formatted message text.
Exploit / POC
Archimede's Glftpd File Modification Vulnerability
There is no exploit required.
There is no exploit required.
References
Archimede's Glftpd File Modification Vulnerability
References:
References:
- Archimede's Glftpd Product Page (Archimede's Glftpd)