PT-2008-6407 · Net2Ftp · Net2Ftp

Tan Chew Keong · Publicado 2008-11-28 · Atualizado 2017-08-08 · CVE-2008-5275

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions net2ftp versions 0.96 through 0.97

Description The issue allows remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a TAR or ZIP archive. This can be leveraged for code execution by creating a .php file.

Recommendations For net2ftp versions 0.96 through 0.97, consider disabling the "Unzip archive" and "Upload files and archives" functionality until a patch is available to prevent exploitation. Restrict access to file upload features to minimize the risk of arbitrary file creation, reading, or deletion. Avoid using the .. (dot dot) notation in filenames within archives to prevent directory traversal.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-5275

Produtos afetados

Net2Ftp

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-5275 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5275 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42994 · Nota
• http://secunia.com/advisories/30611 · Aviso do Fabricante
• http://vuln.sg/net2ftp096-en.html · Nota
• http://securityfocus.com/bid/29664 · Nota