Date: Fri, 2 Feb 2007 23:27:18 +0300
From: 3APA3A <3APA3A@SECURITY.NNOV.RU.>
To: "Steven M. Christey" <coley@mitre.org.>
Subject: Re[2]: Ipswitch WS_FTP Server 5.04 multiple arbitrary code execution vulnerabilities
In-Reply-To: <200702021948.l12JmdAo015240@faron.mitre.org.>
References: <200702021948.l12JmdAo015240@faron.mitre.org.>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: antivirus-gw at tyumen.ru
Dear Steven M. Christey,
In general case, FTP site admin is not necessary host admin. He can
only be allowed to manage users and virtual hosts for FTP. This is
privilege escalation vulnerability from FTP site administrator to local
system account.
In addition, FTP authentication is usually cleartext, and ability to
execute code with local system privileges by any FTP account should be
taken seriously because of Man-in-the-middle attack vector.
--
~/ZARAZA
http://securityvulns.com/
--Friday, February 2, 2007, 10:48:39 PM, you wrote to [email protected]:
SMC> Michal,
SMC> iFTPAddU is for adding users, and iFTPAddH is for adding virtual
SMC> hosts. These sound like administator-level controls. Presumably, the
SMC> same admin already had the access to install WS_FTP in the first
SMC> place. So, it doesn't seem like these cross any privilege boundaries,
SMC> so they don't sound like vulnerabilities.
SMC> Am I missing something here?
SMC> - Steve
