PT-2006-6642 · Selenium · Seleniumserver Ftp Server

Published 2006-11-20 · Updated 2017-07-20 · CVE-2006-5981

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SeleniumServer FTP Server version 1.0 and possibly earlier

Description The issue allows remote attackers to perform directory traversal, enabling them to list arbitrary directories, read arbitrary files, and upload arbitrary files. This is achieved through directory traversal sequences in the DIR (LIST or NLST), GET (RETR), and PUT (STOR) commands.

Recommendations For SeleniumServer FTP Server version 1.0 and possibly earlier, consider restricting access to the FTP server until a fix is available, and avoid using the DIR, GET, and PUT commands with untrusted input.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2006-5981

Affected Products

Seleniumserver Ftp Server

References · 6

• http://secunia.com/advisories/22928 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4540 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5981 · Security Note
• http://whitestar.linuxbox.org/pipermail/exploits/2006-November/000037.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30332 · Note
• http://osvdb.org/30448 · Note