PT-2004-3636 · Pablo Software Solutions · Quick 'N Easy Ftp Server

Published 2004-12-31 · Updated 2018-10-19 · CVE-2004-2747

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pablo Software Solutions Quick 'n Easy FTP Server versions 1.77 and earlier

Description A directory traversal issue allows remote authenticated users to determine the existence of arbitrary files by using a .. (dot dot) in the DEL command. This is done by analyzing different error messages that are triggered depending on whether the file exists or not.

Recommendations For versions 1.77 and earlier, consider restricting access to the DEL command until a patch is available. As a temporary workaround, limit the ability of remote authenticated users to execute the DEL command with .. (dot dot) sequences to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2004-2747

Affected Products

Quick 'N Easy Ftp Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-2747 · Security Note
• http://securityfocus.com/bid/9443 · Patch
• http://osvdb.org/3574 · Note
• http://secunia.com/advisories/10661 · Note
• http://securitytracker.com/id?1008756 · Note
• http://securityfocus.com/archive/1/350224/30/21640/threaded · Note