[NT] Xlight FTP Server Directory Traversal and DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 12/18/03

  • Next message: SecuriTeam: "[UNIX] Aardvark Topsites Multiple Vulnerabilities" 
    To: list@securiteam.com
Date: 18 Dec 2003 15:47:18 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Xlight FTP Server Directory Traversal and DoS
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.xlightftpd.com/> Xlight FTP server is "a powerful ftp server
    with very small program size". Two vulnerabilities have been discovered in
    the product a directory traversal vulnerability (allows remote attackers
    to cause the product to display files that are outside the bound FTP root
    directory) and denial of service attack.

    DETAILS

    Vulnerable systems:
     * Xlight FTP Server version 1.40

    Immune systems:
     * Xlight FTP Server version 1.41

    Directory Traversal:
    Any authenticated user can read arbitrary files outside the bound FTP root
    directory by iussing the following command:
      get ..\[Existent File]
      recev ..\[Existent File]

    Denial of Service:
    Any authenticated user can crash the server by issuing the following
    command:
      cd ~

    Vendor status:
    "Thank you for the information. Vulnerability places under the prog have
    been found , the fix will come out very soon", a new version is available
    on the vendor's web site, the new version (1.41) includes fixes for both
    these vulnerabilities..

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:gss_it@yahoo.com> GSS IT.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Aardvark Topsites Multiple Vulnerabilities"

    Relevant Pages

    • [NT] Comersus Shopping Cart Remote Code Inclusion
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Lack of user input validation in Comersus Shopping Cart can be exploited ... Fore more vulnerabilities in Comersus Shopping Cart Vulnerabilities see: ...
      (Securiteam)
    • [NT] Cross Site Scripting in Yet Another Forum.net
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Cross Site Scripting vulnerabilities were found in Yet Another Forum.net, ... This bulletin is sent to members of the SecuriTeam mailing list. ...
      (Securiteam)
    • [UNIX] ATutor Multiple XSS Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ATutor is "a web based education portal". ... Multiple cross site scripting vulnerabilities have been discovered in the ... JavaScript into the web site displayed by the product. ...
      (Securiteam)
    • [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile, ...
      (Securiteam)
    • [NT] Novell eDirectory Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Multiple Vulnerabilities ... Three different vulnerabilities were discovered in Novell's eDirectory ... NCP over IP length Heap Overflow: ...
      (Securiteam)