[NT] Xlight FTP Server Directory Traversal and DoS

• Previous message: SecuriTeam: "[NEWS] Cisco FWSM Multiple Vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 18 Dec 2003 15:47:18 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  Xlight FTP Server Directory Traversal and DoS
------------------------------------------------------------------------

SUMMARY

 <http://www.xlightftpd.com/> Xlight FTP server is "a powerful ftp server
with very small program size". Two vulnerabilities have been discovered in
the product a directory traversal vulnerability (allows remote attackers
to cause the product to display files that are outside the bound FTP root
directory) and denial of service attack.

DETAILS

Vulnerable systems:
 * Xlight FTP Server version 1.40

Immune systems:
 * Xlight FTP Server version 1.41

Directory Traversal:
Any authenticated user can read arbitrary files outside the bound FTP root
directory by iussing the following command:
  get ..\[Existent File]
  recev ..\[Existent File]

Denial of Service:
Any authenticated user can crash the server by issuing the following
command:
  cd ~

Vendor status:
"Thank you for the information. Vulnerability places under the prog have
been found , the fix will come out very soon", a new version is available
on the vendor's web site, the new version (1.41) includes fixes for both
these vulnerabilities..

ADDITIONAL INFORMATION

The information has been provided by <mailto:gss_it@yahoo.com> GSS IT.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] Cisco FWSM Multiple Vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

• [NT] Comersus Shopping Cart Remote Code Inclusion
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Lack of user input validation
  in Comersus Shopping Cart can be exploited ... Fore more vulnerabilities in Comersus
  Shopping Cart Vulnerabilities see: ... (Securiteam)
• [NT] Cross Site Scripting in Yet Another Forum.net
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Cross Site Scripting
  vulnerabilities were found in Yet Another Forum.net, ... This bulletin is sent to members
  of the SecuriTeam mailing list. ... (Securiteam)
• [UNIX] ATutor Multiple XSS Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... ATutor is "a web based
  education portal". ... Multiple cross site scripting vulnerabilities have been discovered
  in the ... JavaScript into the web site displayed by the product. ... (Securiteam)
• [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops
  and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow
  vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions,
  rxsDeleteFile, ... (Securiteam)
• [NT] Novell eDirectory Multiple Vulnerabilities
  ... The following security advisory is sent to the securiteam mailing list, and can be
  found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Multiple
  Vulnerabilities ... Three different vulnerabilities were discovered in Novell's eDirectory
  ... NCP over IP length Heap Overflow: ... (Securiteam)