PT-2004-3636 · Pablo Software Solutions · Quick 'N Easy Ftp Server

Publicado 2004-12-31 · Atualizado 2018-10-19 · CVE-2004-2747

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pablo Software Solutions Quick 'n Easy FTP Server versions 1.77 and earlier

Description A directory traversal issue allows remote authenticated users to determine the existence of arbitrary files by using a .. (dot dot) in the DEL command. This is done by analyzing different error messages that are triggered depending on whether the file exists or not.

Recommendations For versions 1.77 and earlier, consider restricting access to the DEL command until a patch is available. As a temporary workaround, limit the ability of remote authenticated users to execute the DEL command with .. (dot dot) sequences to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2004-2747

Produtos afetados

Quick 'N Easy Ftp Server

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-2747 · Nota de Segurança
• http://osvdb.org/3574 · Nota
• http://secunia.com/advisories/10661 · Nota
• http://securityfocus.com/bid/9443 · Correção
• http://securitytracker.com/id?1008756 · Nota
• http://securityfocus.com/archive/1/350224/30/21640/threaded · Nota