WFTPD directory traversal
| wftpd-dir-traverse (5608) |  Medium Risk |
Description:
Winsock FTPd (WFTPD) could allow a remote attacker to traverse directories on the server. A remote attacker can issue an CD or LS command to the FTP server containing "dot dot" sequences (/../..) or containing a modified "dot dot" sequence with three dots (.../) to change the working directory to any directory on the server. Issuing a standard "dot dot" sequence (../../) is restricted in the configuration. An attacker can use this vulnerability to download any file from the server and gain access to sensitive information if WFTPD is installed on an operating system drive.
Consequences:
Gain Access
Remedy:
For WFTPD (all versions):
Upgrade to WFTPD (3.10 R1 or later) or (Pro 3.10 R1 or later), available from Texas Imperial Softwares Web site. See References.
References:
- BugTraq Mailing List, Mon May 27 2002 - 13:39:29 CDT: Problems with various windows FTP servers.
- BugTraq Mailing List, Mon Nov 27 2000 - 09:21:15 CST: Vulnerability in Winsock FTPD 2.41/3.00 (Pro).
- BugTraq Mailing List, Sat May 26 2001 - 03:24:25 CDT: WFTPD 32-bit (X86) 3.00 R5 Directory Traversal / Buffer Overflow / DoS.
- CIAC Information Bulletin L-024: Microsoft Texas Imperial Software WFTPD 3.0Pro Vulnerability.
- Texas Imperial Software Web site: Index of /downloads.
- Texas Imperial Software Web site: 5/24/2001 - Directory traversal vulnerability - Windows 95, 98, ME.
- BID-2005: Winsock FTPd Directory Transversal Vulnerability
- BID-2779: WFTPD 3.00 R5 Directory Traversal Vulnerability
- CVE-2000-1101: Directory traversal vulnerability in Winsock FTPd (WFTPD) 3.00 and 2.41 with the Restrict to home directory option enabled allows local users to escape the home directory via a /../ string, a variation of the .. (dot dot) attack.
- CVE-2001-0694: Directory traversal vulnerability in WFTPD 3.00 R5 allows a remote attacker to view arbitrary files via a dot dot attack in the CD command.
Platforms Affected:
- Texas Imperial Software WFTPD 3.00 R5
- Texas Imperial Software WFTPD Pro 3.00
Reported:
Nov 27, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net