Small ftpd Directory Traversal Vulnerability


Release Date:
2003-05-02

Critical:
Moderately critical
Impact:
Exposure of system information
Exposure of sensitive information

Where:
From remote


Software:
Small ftpd 1.x



Description:
Small ftpd fails to verify input supplied to the command "CWD". This allows malicious users to supply '\..' as an argument, thus allowing them to traverse the directory structure.

The vulnerability has been reported in version 1.02. Other versions may also be affected.

Solution:
Allow only trusted users access. Filter malicious requests in a FTP proxy or firewall with filtering capabilities.

Reported by / credits:
aT4r InsaN3