PT-2006-6642 · Selenium · Seleniumserver Ftp Server

Publicado 2006-11-20 · Atualizado 2017-07-20 · CVE-2006-5981

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SeleniumServer FTP Server version 1.0 and possibly earlier

Description The issue allows remote attackers to perform directory traversal, enabling them to list arbitrary directories, read arbitrary files, and upload arbitrary files. This is achieved through directory traversal sequences in the DIR (LIST or NLST), GET (RETR), and PUT (STOR) commands.

Recommendations For SeleniumServer FTP Server version 1.0 and possibly earlier, consider restricting access to the FTP server until a fix is available, and avoid using the DIR, GET, and PUT commands with untrusted input.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2006-5981

Produtos afetados

Seleniumserver Ftp Server

Referências · 6

• http://secunia.com/advisories/22928 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/4540 · Aviso do Fabricante
• http://whitestar.linuxbox.org/pipermail/exploits/2006-November/000037.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30332 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5981 · Nota de Segurança
• http://osvdb.org/30448 · Nota