PT-2008-2814 · Microworld · Escan Corporate Edition+2

Published 2008-03-10 · Updated 2018-10-11 · CVE-2008-1221

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MicroWorld eScan Corporate Edition version 9.0.742.98 MicroWorld eScan Management Console (aka eScan Server) version 9.0.742.1

Description The issue allows remote attackers to read arbitrary files via an absolute pathname in the RETR (get) command. This is due to an absolute path traversal vulnerability in the FTP server.

Recommendations For MicroWorld eScan Corporate Edition version 9.0.742.98, update to a version that fixes this issue. For MicroWorld eScan Management Console (aka eScan Server) version 9.0.742.1, update to a version that fixes this issue. As a temporary workaround, consider restricting access to the FTP server until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-1221

Affected Products

Escan Corporate Edition

Escan Management Console

Escan Server

References · 8

• 🔥 https://exploit-db.com/exploits/31345 · Exploit
• 🔥 http://securityfocus.com/bid/28127 · Exploit
• 🔥 http://aluigi.altervista.org/adv/escaz-adv.txt · Exploit
• 🔥 http://secunia.com/advisories/29246 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1221 · Security Note
• http://securityfocus.com/archive/1/489228/100/0/threaded · Note
• http://securityreason.com/securityalert/3723 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41033 · Note