PT-2008-6407 · Net2Ftp · Net2Ftp

Tan Chew Keong · Published 2008-11-28 · Updated 2017-08-08 · CVE-2008-5275

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions net2ftp versions 0.96 through 0.97

Description The issue allows remote attackers to create, read, or delete arbitrary files via a .. (dot dot) in a filename within a TAR or ZIP archive. This can be leveraged for code execution by creating a .php file.

Recommendations For net2ftp versions 0.96 through 0.97, consider disabling the "Unzip archive" and "Upload files and archives" functionality until a patch is available to prevent exploitation. Restrict access to file upload features to minimize the risk of arbitrary file creation, reading, or deletion. Avoid using the .. (dot dot) notation in filenames within archives to prevent directory traversal.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-5275

Affected Products

Net2Ftp

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-5275 · Security Note
• http://secunia.com/advisories/30611 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5275 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42994 · Note
• http://vuln.sg/net2ftp096-en.html · Note
• http://securityfocus.com/bid/29664 · Note