Forums: Pablo Ftp Server Allows Remote Detection Of Local - Forums

CRITICAL:
Not critical

IMPACT:
Exposure of system information

WHERE:
From remote

SOFTWARE:
Pablo FTP Server 1.x

DESCRIPTION:
Arnaud Jacques has identified a vulnerability in Pablo FTP Server,
allowing malicious people to determine if a certain file exists on a
vulnerable system.

The problem is that the "del" command returns different error
messages. A "550 Permission denied" error message is returned when a
file exists, whereas a "550 File not found" error message is returned
when the file doesn't exist. This can be exploited to enumerate the
presence of files using the "../" character sequence.

The vulnerability affects version 1.77 and possibly prior.

SOLUTION:
Update to version 1.8.
http://www.pablovand...ftp_server.html

PROVIDED AND/OR DISCOVERED BY:
Arnaud Jacques aka scrap

----------------------------------------------------------------------