PT-2010-4545 · Smartftp · Smartftp Client

Published 2010-08-20 · Updated 2010-08-23 · CVE-2010-3099

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SmartFTP Client versions 4.0.1124.0 through 4.0 Build 1133

Description A directory traversal issue allows remote FTP servers to overwrite arbitrary files by including a ".." (dot dot backslash) in a filename.

Recommendations For versions 4.0.1124.0 through 4.0 Build 1133, update to a version after 4.0 Build 1133 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-3099

Affected Products

Smartftp Client

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-3099 · Security Note
• http://secunia.com/advisories/40899 · Vendor Advisory
• http://smartftp.com/forums/index.php?/topic/16425-smartftp-client-40-change-log · Note
• http://htbridge.ch/advisory/directory_traversal_in_smartftp.html · Note