Date: Tue, 12 Nov 2002 17:56:06 +0200
From: Tamer Sahin <[email protected]>
To: [email protected]Subject: [SecurityOffice] Hyperion Ftp Server v2.8.1 Directory Traversal Vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: MD5
- --[ Hyperion Ftp Server v2.8.1 Directory Traversal Vulnerability ]--
- --[ Type
Directory Traversal
- --[ Release Date
November 12, 2002
- --[ Product / Vendor
Hyperion FTP Server is a powerful, reliable FTP server for Windows 95/98/NT/2000,
and supports all basic FTP commands, and much more, such as passive mode.
http://www.mollensoft.com
- --[ Summary
A vulnerability exists in Hyperion Ftp Server which allows a remote user to
traverse the directories of a target host. This may lead to the disclosure of
file and directory contents. Arbitrary directories can be accessed through the
use of double dot '../' techniques when using the 'ls' command.
- --[ Tested
Hyperion Ftp Server v2.8.1 / Windows 2000 sp3
Hyperion Ftp Server v2.8.1 / Windows 98 SE
- --[ Vulnerable
Hyperion Ftp Server v2.8.1 / Windows 2000 sp3
Hyperion Ftp Server v2.8.1 / Windows 98 SE
- --[ Disclaimer
http://www.securityoffice.net is not responsible for the misuse or illegal
use of any of the information and/or the software listed on this security advisory.
- --[ Author
Tamer Sahin
[email protected]http://www.securityoffice.net
All our advisories can be viewed at http://www.securityoffice.net/articles/
Please send suggestions, updates, and comments to [email protected]
(c) 2002 SecurityOffice
This Security Advisory may be reproduced and distributed, provided that this Security
Advisory is not modified in any way and is attributed to SecurityOffice and provided
that such reproduction and distribution is performed for non-commercial purposes.
Tamer Sahin
http://www.securityoffice.net
-----BEGIN PGP SIGNATURE-----
Version: 2.6
iQEVAwUAPdEkmfpL5ibJRTtBAQG+vQf9GzkLL9lQQ4uGvfo003Ib5iLEmj88WdYg
HieDqwYYrjAI5MhtAeQY3iUKicC7wrcgQufymY9/WmyhyePk79Kei6CO4EbveJWu
sDxBv6qvDNPr245VS8pTpKzfeZvVH+l3oH7kELSF5dnMPsbMn5M7Jpn5slWvsMRW
OC6QwvGMNusKTIcEEWxtrGgJ/RWCmynQi01gskzcVD1Fi8xeYByIZWo0KEJyla9N
c9UNHASxOErByEoJnrNuVkLBWs0dKuHHwuFu1PFfJvpCoK2WUL8RIR24DNA/U5w2
+Ojux8ZoaYT0pTfmfYw7Qy+5E83mbpA8FhDpi9etW/iM6ZYmcUaYeA==
=az2D
-----END PGP SIGNATURE-----
