The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Tridcomm FTP Server Directory Traversal
------------------------------------------------------------------------
SUMMARY
" <http://www.tridcomm.com/> TriDComm is a freeware 3D file manager and a
3D trace router for Windows."
TriDComm's built-in FTP server is vulnerable to directory traversal, which
in turn allows a remote user to view any accessible file on the system and
upload just as well.
DETAILS
Vulnerable Systems:
* TriDComm version 1.3 and prior
TriDComm comes bundled with a built-in FTP server which is disabled by
default. However, when enabled, the FTP server poses a major security
threat, as it is vulnerable to directory traversal.
Using this, an attacker is not only able to view any accessible file on
the system, by the FTP server, but also upload files to the system.
Examples:
dir ../../
dir /
get ../../windows/win.ini win.ini
put evil.exe ../../windows/calc.exe
ADDITIONAL INFORMATION
The information has been provided by <mailto:aluigi@autistici.org> Luigi
Auriemma.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
