PT-2010-4542 · Softx · Softx Ftp Client

Publicado 2010-08-20 · Atualizado 2018-10-10 · CVE-2010-3096

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SoftX FTP Client versions 3.3 and earlier

Description The issue allows remote FTP servers to write arbitrary files to the system by using ".." (dot dot backslash) sequences in a filename, which can lead to unauthorized file creation.

Recommendations For SoftX FTP Client versions 3.3 and earlier, consider restricting access to the FTP client until a patch is available, and avoid using the FTP client to connect to untrusted FTP servers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-3096

Produtos afetados

Softx Ftp Client

Referências · 4

• http://htbridge.ch/advisory/directory_traversal_in_softx_ftp_client.html · Nota
• http://securityfocus.com/archive/1/513085/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3096 · Nota de Segurança
• http://secunia.com/advisories/40973 · Aviso do Fabricante