PT-2008-4219 · Globalscape · Cuteftp Home+1

Publicado 2008-06-19 · Atualizado 2017-08-08 · CVE-2008-2779

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CuteFTP Home version 8.2.0 Build 02.26.2008.4 CuteFTP Pro version 8.2.0 Build 04.01.2008.1

Description A directory traversal issue allows remote FTP servers to create or overwrite arbitrary files via .. (dot dot backslash) sequences in responses to LIST commands. This can potentially be leveraged for code execution by writing to a Startup folder.

Recommendations For CuteFTP Home version 8.2.0 Build 02.26.2008.4, consider disabling the ability to write files to arbitrary locations until a patch is available. For CuteFTP Pro version 8.2.0 Build 04.01.2008.1, restrict access to the LIST command to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-2779

Produtos afetados

Cuteftp Home

Cuteftp Pro

Referências · 6

• 🔥 http://vuln.sg/cuteftp820-en.html · Exploit
• http://secunia.com/advisories/29760 · Aviso do Fabricante
• http://securitytracker.com/id?1020113 · Nota
• http://vupen.com/english/advisories/2008/1653/references · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2779 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42633 · Nota