PT-2007-5907 · Ghisler · Total Commander

Published 2007-09-08 · Updated 2018-10-15 · CVE-2007-4756

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Total Commander versions prior to 7.02

Description: A directory traversal issue exists in the FTP client, allowing remote FTP servers to create or overwrite arbitrary files using ".." sequences in a filename. These sequences are not displayed when the user lists files. This issue can be leveraged for code execution by writing to a Startup folder.

Recommendations: For versions prior to 7.02, update to version 7.02 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP client until the update is applied. Avoid using the FTP client to connect to untrusted remote FTP servers until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2007-4756

Affected Products

Total Commander

References · 12

• 🔥 http://securityfocus.com/bid/25581 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-4756 · Security Note
• http://ghisler.com/whatsnew.htm · Patch
• http://secunia.com/advisories/26734 · Vendor Advisory
• http://osvdb.org/39838 · Note
• http://securityreason.com/securityalert/3106 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36487 · Note
• http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt · Note
• http://securityfocus.com/archive/1/478720/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36486 · Note
• http://securitytracker.com/id?1018662 · Note
• http://vupen.com/english/advisories/2007/3102 · Note