Xlight FTPd Multiple Directory Traversal in SFTP Jul 05 2010 11:51PM
bill accensussecurity com
Accensus Security Group Vulnerability Advisory [L-03]

Date: 7/5/2010

Vendor: http://www.xlightftpd.com/

Effected Software: Xlight FTP Server 3.5.5

Description of Vulnerability:

The SFTP server contains several directory traversal vulnerabilities: get, ls, rm, rename, etc. For example get ../../../../boot.ini will grab c:\boot.ini

Severity: Medium

Local / Remote: Local

Timeline:

Vendor informed 7/2, fix released 7/4

www.accensussecurity.com

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus