Date: 12 Oct 2004 10:40:10 +0200
From: SecuriTeam <[email protected]>
To: [email protected]Subject: [NT] Tridcomm FTP Server Directory Traversal
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Tridcomm FTP Server Directory Traversal
------------------------------------------------------------------------
SUMMARY
" <http://www.tridcomm.com/>; TriDComm is a freeware 3D file manager and a
3D trace router for Windows."
TriDComm's built-in FTP server is vulnerable to directory traversal, which
in turn allows a remote user to view any accessible file on the system and
upload just as well.
DETAILS
Vulnerable Systems:
* TriDComm version 1.3 and prior
TriDComm comes bundled with a built-in FTP server which is disabled by
default. However, when enabled, the FTP server poses a major security
threat, as it is vulnerable to directory traversal.
Using this, an attacker is not only able to view any accessible file on
the system, by the FTP server, but also upload files to the system.
Examples:
dir ../../
dir /
get ../../windows/win.ini win.ini
put evil.exe ../../windows/calc.exe
ADDITIONAL INFORMATION
The information has been provided by <mailto:[email protected]> Luigi
Auriemma.
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
