Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.

An updated gFTP package that fixes a directory traversal issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

gFTP is a multi-threaded FTP client for the X Window System.

A directory traversal bug was found in gFTP. If a user can be tricked into downloading a file from a malicious ftp server, it is possible to overwrite arbitrary files owned by the victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0372 to this issue.

Users of gftp should upgrade to this updated package, which contains a backported fix for this issue.

- Fri Feb 18 2005 Warren Togami <wtogami at redhat.com>     2.0.18-0.FC3

  - FC3 (including CVE-2005-0372)

  - Thu Feb 10 2005 Warren Togami <wtogami at redhat.com>     2.0.18-1

  - 2.0.18

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A Debian Security Advisory reports :

Albert Puigsech Galicia discovered a directory traversal vulnerability in a proprietary FTP client (CAN-2004-1376) which is also present in gftp, a GTK+ FTP client. A malicious server could provide a specially crafted filename that could cause arbitrary files to be overwritten or created by the client.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:410 advisory.

    gFTP is a multi-threaded FTP client for the X Window System.

    A directory traversal bug was found in gFTP. If a user can be tricked into     downloading a file from a malicious ftp server, it is possible to overwrite     arbitrary files owned by the victim. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0372 to     this issue.

    Users of gftp should upgrade to this updated package, which contains a     backported fix for this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Fri Feb 18 2005 Warren Togami <wtogami at redhat.com>     2.0.18-0.FC2

  - FC2 (including CVE-2005-0372)

  - Thu Feb 10 2005 Warren Togami <wtogami at redhat.com>     2.0.18-1

  - 2.0.18

  - Tue Jun 15 2004 Elliot Lee <sopwith at redhat.com>

  - rebuilt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in gftp could allow a malicious FTP server to overwrite files on the local system as the user running gftp due to improper handling of filenames containing slashes.

The updated packages are patched to deal with these issues.

The remote host is affected by the vulnerability described in GLSA-200502-27 (gFTP: Directory traversal vulnerability)

    gFTP lacks input validation of filenames received by remote     servers.
  Impact :

    An attacker could entice a user to connect to a malicious FTP     server and conduct a directory traversal attack by making use of     specially crafted filenames. This could lead to arbitrary files being     created or overwritten.
  Workaround :

    There is no known workaround at this time.

Albert Puigsech Galicia discovered a directory traversal vulnerability in a proprietary FTP client ( CAN-2004-1376) which is also present in gftp, a GTK+ FTP client. A malicious server could provide a specially crafted filename that could cause arbitrary files to be overwritten or created by the client.

ID	Name	Product	Family	Severity
21819	CentOS 3 / 4 : gftp (CESA-2005:410)	Nessus	CentOS Local Security Checks	medium
19647	Fedora Core 3 : gftp-2.0.18-0.FC3 (2005-309)	Nessus	Fedora Local Security Checks	medium
18888	FreeBSD : gftp -- directory traversal vulnerability (2d8cf857-81ea-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18470	RHEL 4 : gftp (RHSA-2005:410)	Nessus	Red Hat Local Security Checks	high
18334	Fedora Core 2 : gftp-2.0.18-0.FC2 (2005-310)	Nessus	Fedora Local Security Checks	medium
17279	Mandrake Linux Security Advisory : gftp (MDKSA-2005:050)	Nessus	Mandriva Local Security Checks	medium
17153	GLSA-200502-27 : gFTP: Directory traversal vulnerability	Nessus	Gentoo Local Security Checks	medium
17136	Debian DSA-686-1 : gftp - missing input sanitising	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-0372

high

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium