Info

Disclosure

Apr 25, 2005

Discovery

Apr 17, 2005

Dates

Exploit

Apr 25, 2005

Solution

Unknown

Description

FastStream NETFile FTP/Web server contains a flaw that allows a remote attacker to create/remove directories and/or upload/delete files outside of the web path. The issue is due to the web interface not properly sanitizing user input, specifically traversal style attacks (../../) supplied via the 'command' variable.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to version 7.5.0 Beta 7 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

FastStream Technologies

NETFile FTP/Web Server

7.4.6

References

Security Tracker: 1013803
Bugtraq ID: 13388
ISS X-Force ID: 20272
Vendor URL: http://www.fastream.com/netfileserver.htm
Other Advisory URL: http://www.securiteam.com/windowsntfocus/5FP0P20FFK.html
http://www.security.org.sg/vuln/netfileftp746.html

Credit

Chew Keong TAN - chewkeongsecurity.org.sg - SIG^2

Direct URL: http://osvdb.org/36218