PT-2007-5907 · Ghisler · Total Commander

Publicado 2007-09-08 · Atualizado 2018-10-15 · CVE-2007-4756

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Total Commander versions prior to 7.02

Description: A directory traversal issue exists in the FTP client, allowing remote FTP servers to create or overwrite arbitrary files using ".." sequences in a filename. These sequences are not displayed when the user lists files. This issue can be leveraged for code execution by writing to a Startup folder.

Recommendations: For versions prior to 7.02, update to version 7.02 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP client until the update is applied. Avoid using the FTP client to connect to untrusted remote FTP servers until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2007-4756

Produtos afetados

Total Commander

Referências · 12

• 🔥 http://securityfocus.com/bid/25581 · Exploit
• http://osvdb.org/39838 · Nota
• http://securityreason.com/securityalert/3106 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4756 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36487 · Nota
• http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt · Nota
• http://securityfocus.com/archive/1/478720/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36486 · Nota
• http://ghisler.com/whatsnew.htm · Correção
• http://securitytracker.com/id?1018662 · Nota
• http://vupen.com/english/advisories/2007/3102 · Nota
• http://secunia.com/advisories/26734 · Aviso do Fabricante