Bugtraq: Re: Problems with various windows FTP servers

[ByteRage <byterage () yahoo com>]

--- SnakeByte / Eric Sesterhenn <snakebyte () gmx de>
<snip>
> Texas Imperial Software WFTPD
>  CWD ...
>  CWD ....
>  directory traversal possible
<snip>

I have already posted this bug to bugtraq on May 24,
2001
(cfr. http://online.securityfocus.com/bid/2779/)

The bug has been fixed in version 3.10 release 1
(cfr. http://online.securityfocus.com/bid/2779/info/)

I have verified this with WFTPD 32-bit (X86) version
3.10 release 1 9/27/2001, and this version is patched
against this bug (both CWD ... & CWD ....), since the
server returns :

501 User is not allowed to change to ... - returning
to /.

or

501 User is not allowed to change to .... - returning
to /.

(/ is the homedirectory of the user, not the
rootdirectory)

cheers,

[ByteRage]

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com