PT-2002-2272 · Ncftp+2 · Ncftp+3

Published 2002-12-17 · Updated 2018-10-30 · CVE-2002-1345

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: No specific software name or versions are mentioned, so the description is: UNIX systems (affected versions not specified)

Description: The issue concerns directory traversal vulnerabilities in multiple FTP clients on UNIX systems. These vulnerabilities allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-1345

Affected Products

Ncftp

Openbsd

Solaris

Sunos

References · 7

• http://kb.cert.org/vuls/id/210409 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-1345 · Security Note
• ftp://patches.sgi.com/support/free/security/advisories/20021205-01-A · Vendor Advisory
• http://marc.info/?l=bugtraq&m=103962838628940&w=2 · Note
• http://securityfocus.com/bid/6360 · Note
• http://iss.net/security_center/static/10821.php · Note
• http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0102.html · Note