Vulnerability Note VU#110803

CrushFTP Server does not adequately filter user input thereby permitting directory traversal

Overview

CrushFTP allows access to files outside the FTP root directory through directory traversal.

I. Description

CrushFTP is a Java-based FTP server available for Linux, Mac OS, and Windows. CrushFTP can be configured to limit access to files under a designated FTP root directory. However, CrushFTP allows an attacker to get files outside this directory through '../' directory traversal.

II. Impact

CrushFTP allows an attacker to see any file in the filesystem, including potentially sensitive and critical system files.

III. Solution

Upgrade to version 2.1.7 or later of CrushFTP at:

http://www.crushftp.com
Use chroot if available on your system, to limit the scope of CrushFTP's access to the filesystem.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Ben Spink	Vulnerable	17-Nov-2001

References

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0583
http://xforce.iss.net/static/6495.php
http://xforce.iss.net/alerts/vol-6_num-7.php

Credit

Thanks to Joe Testa for discovering this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

Date Public:	2001-05-23
Date First Published:	2001-12-20
Date Last Updated:	2001-12-20
CERT Advisory:
CVE-ID(s):	CAN-2001-0582
NVD-ID(s):	CAN-2001-0582
US-CERT Technical Alerts:
Severity Metric:	0.11
Document Revision:	12

If you have feedback, comments, or additional information about this vulnerability, please send us email.