Microsoft Internet Explorer FTP arbitrary file creation
| ie-ftp-create-files (18723) |  Medium Risk |
Description:
Microsoft Internet Explorer could allow a remote attacker to create an arbitrary file on the victim's system, caused by improper handling of FTP file transfers. A remote attacker, in control of a malicious FTP server, could create a malicious file containing "dot dot" traversal sequences in the filename, which would be downloaded to the vulnerable system, once the malicious file is dragged or copied.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in the Microsoft Security Bulletin MS05-044. See References.
References:
- BugTraq Mailing List, Thu Dec 30 2004 - 08:56:41 CST : 7a69Adv#17 - Internet Explorer FTP download path disclosure.
- Microsoft Security Bulletin MS05-044: Vulnerability in the Windows FTP Client Could Allow File Transfer Location Tampering (905495).
- CVE-2004-1376: Directory traversal vulnerability in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote malicious FTP servers to overwrite arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
- CVE-2005-2126: The FTP client in Windows XP SP1 and Server 2003, and Internet Explorer 6 SP1 on Windows 2000 SP4, when Enable Folder View for FTP Sites is enabled and the user manually initiates a file transfer, allows user-assisted, remote FTP servers to overwrite files in arbitrary locations via crafted filenames.
- OSVDB ID: 12698: Microsoft IE FTP Download Traversal Arbitrary Command Execution
- SA13704: Internet Explorer FTP Download Directory Traversal
- SA17163: Microsoft Windows FTP Client Filename Validation Vulnerability
- SA17172: Avaya Various Products Multiple Vulnerabilities
- SA17223: Nortel Centrex IP Client Manager Multiple Vulnerabilities
- SECTRACK ID: 1015036: Microsoft Windows FTP Client Input Validation Hole Lets Remote Servers Create/Overwrite Files on the Target User`s System
- US-CERT VU#415828: Microsoft Windows FTP client does not properly validate received file names
Platforms Affected:
- Microsoft Internet Explorer 6.0 SP1
- Microsoft Windows 2000 SP4
- Microsoft Windows 2003 Server Itanium
- Microsoft Windows XP SP1
Reported:
Jan 01, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this