Multiple FTP client malicious file name directory traversal
| ftp-client-filename-traversal (10821) |  Medium Risk |
Description:
Multiple vendor FTP clients could allow a remote attacker in control of a malicious FTP server to traverse directories and create or overwrite files on a victim's computer. If a remote attacker could force a victim to visit the malicious FTP server and issue a LIST or a NLST command, the attacker could use specially-crafted file names containing the absolute path to the targeted directory, a system drive letter (C:), typical "dot dot" sequences (../), or modified "dot dot" sequences (in the form of ..\ or ...) to traverse directories and create or overwrite files with the same privileges as the FTP client.
Consequences:
File Manipulation
Remedy:
Refer to CERT Vulnerability Note VU#210409 for vendor specific upgrade or patch information. See References.
References:
- SGI Security Advisory 20021205-01-A: Directory Traversal Vulnerability in FTP Client.
- VulnWatch Mailing List, Tue Dec 10 2002 - 18:22:40 CST : Directory Traversal Vulnerabilities in FTP Clients.
- BID-6360: Multiple Vendor FTP Client Side File Overwriting Vulnerability
- CVE-2002-1345: Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences.
- US-CERT VU#210409: Multiple FTP clients contain directory traversal vulnerabilities
Platforms Affected:
- IETF FTP
Reported:
Dec 10, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net