PT-2013-68 · Rhinosoft · Serv-U File Server

Published 2013-10-02 · Updated 2013-10-02

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Serv-U File Server (affected versions not specified)

Description The issue is related to a lack of proper handling of file system access using advanced NTFS syntax. This can be exploited when a URL requested by a user is mapped to locations defined in the web server configuration, allowing a remote attacker to obtain the source code of arbitrary scripts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-41

Related Identifiers

BDU:2014-00412

Affected Products

Serv-U File Server

References · 2

• https://bdu.fstec.ru/vul/2014-00412 · Security Note
• http://securitylab.ru/lab/PT-2013-68 · Note