PT-2010-4542 · Softx · Softx Ftp Client

Published 2010-08-20 · Updated 2018-10-10 · CVE-2010-3096

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SoftX FTP Client versions 3.3 and earlier

Description The issue allows remote FTP servers to write arbitrary files to the system by using ".." (dot dot backslash) sequences in a filename, which can lead to unauthorized file creation.

Recommendations For SoftX FTP Client versions 3.3 and earlier, consider restricting access to the FTP client until a patch is available, and avoid using the FTP client to connect to untrusted FTP servers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-3096

Affected Products

Softx Ftp Client

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-3096 · Security Note
• http://secunia.com/advisories/40973 · Vendor Advisory
• http://htbridge.ch/advisory/directory_traversal_in_softx_ftp_client.html · Note
• http://securityfocus.com/archive/1/513085/100/0/threaded · Note