PT-2008-4261 · 3D Ftp · 3D-Ftp Client

Publicado 2008-06-23 · Atualizado 2017-08-08 · CVE-2008-2822

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 3D-FTP Client version 8.01 (8.0 build 1)

Description The issue concerns multiple directory traversal vulnerabilities in the FTP client. These vulnerabilities allow remote FTP servers to create or overwrite arbitrary files by including a .. (dot dot) in responses to certain commands, specifically the LIST or MLSD commands.

Recommendations For 3D-FTP Client version 8.01 (8.0 build 1), consider restricting access to the FTP client until a fix is available, and avoid using the LIST and MLSD commands on untrusted FTP servers to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-2822

Produtos afetados

3D-Ftp Client

Referências · 8

• 🔥 http://securityfocus.com/bid/29749 · Exploit
• 🔥 http://vuln.sg/3dftp801-en.html · Exploit
• 🔥 https://exploit-db.com/exploits/31921 · Exploit
• http://3dftp.com/3dftp_versions.htm · Nota
• http://secunia.com/advisories/30651 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-2822 · Nota de Segurança
• http://vupen.com/english/advisories/2008/1853/references · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43095 · Nota