Detections
Analytics

Multiple FTP Server quote stat Command Traversal Arbitrary Directory Access

medium Nessus Plugin ID 11679

Language:

Synopsis

The remote FTP server is prone to a directory traversal attack.

Description

The remote FTP server is vulnerable to a flaw that allows users to access files outside the FTP server root.

An attacker may break out of his FTP jail by issuing the command :

ftp> quote stat ../*

Some versions of VisNetic FTP Server and Titan FTP Server are known to be affected by this issue.

Solution

Contact your vendor for a patch.

See Also

http://www.nessus.org/u?f82b50d3

Plugin Details

Severity: Medium

ID: 11679

File Name: visnetic_and_titan_ftp_traversal.nasl

Version: 1.24

Type: remote

Family: FTP

Published: 6/2/2003

Updated: 8/8/2018

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Vulnerability Information

Required KB Items: Settings/ParanoidReport, ftp/login

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 5/29/2003

Reference Information

BID: 7718