{"id": "CVE-2007-4756", "bulletinFamily": "NVD", "title": "CVE-2007-4756", "description": "Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via \"..\\\" (dot dot backslash) sequences in a filename. NOTE: the \"..\\\" are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.", "published": "2007-09-07T21:17:00", "modified": "2017-07-28T21:33:11", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4756", "reporter": "NVD", "references": ["http://www.ghisler.com/whatsnew.htm", "http://www.securityfocus.com/archive/1/archive/1/478720/100/0/threaded", "http://www.vupen.com/english/advisories/2007/3102", "https://exchange.xforce.ibmcloud.com/vulnerabilities/36486", "http://securityreason.com/securityalert/3106", "https://exchange.xforce.ibmcloud.com/vulnerabilities/36487", "http://www.securitytracker.com/id?1018662", "http://www.securityfocus.com/bid/25581", "http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt"], "cvelist": ["CVE-2007-4756"], "type": "cve", "lastseen": "2017-07-29T11:22:14", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:ghisler:total_commander:7.01"], "cvelist": ["CVE-2007-4756"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via \"..\\\" (dot dot backslash) sequences in a filename. NOTE: the \"..\\\" are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.", "edition": 1, "enchantments": {}, "hash": "9e694906b795c0fff5999fa6ddeed2805cf33f492d3c2a0bc674477a4ccd90d3", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "71783463cb40dff8b9f9e46bbbf5efb9", "key": "references"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "141eaae15d13af059eb69e7ef4e1a1ed", "key": "published"}, {"hash": "d689a502c3e8482818918054e3d9c614", "key": "cvelist"}, {"hash": "21c47823d004f5375ef35aaf39d00b95", "key": "cpe"}, {"hash": "1a54dd3bc8a77c5b84a22fcdf9ed95c0", "key": "modified"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "dbf4619ca04c9103b5c6cb1d40c8927e", "key": "title"}, {"hash": "fb6654ae01fd4a7a7348445fe5cfb59b", "key": "description"}, {"hash": "d835e26c030545bd2e43facf67454316", "key": "href"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4756", "id": "CVE-2007-4756", "lastseen": "2016-09-03T09:28:02", "modified": "2011-03-07T21:59:08", "objectVersion": "1.2", "published": "2007-09-07T21:17:00", "references": ["http://xforce.iss.net/xforce/xfdb/36487", "http://www.ghisler.com/whatsnew.htm", "http://xforce.iss.net/xforce/xfdb/36486", "http://www.securityfocus.com/archive/1/archive/1/478720/100/0/threaded", "http://www.vupen.com/english/advisories/2007/3102", "http://securityreason.com/securityalert/3106", "http://www.securitytracker.com/id?1018662", "http://www.securityfocus.com/bid/25581", "http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt"], "reporter": "NVD", "scanner": [], "title": "CVE-2007-4756", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T09:28:02"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "21c47823d004f5375ef35aaf39d00b95"}, {"key": "cvelist", "hash": "d689a502c3e8482818918054e3d9c614"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}, {"key": "description", "hash": "fb6654ae01fd4a7a7348445fe5cfb59b"}, {"key": "href", "hash": "d835e26c030545bd2e43facf67454316"}, {"key": "modified", "hash": "e2d7e6c55cd8eed6a574a88ac50e1680"}, {"key": "published", "hash": "141eaae15d13af059eb69e7ef4e1a1ed"}, {"key": "references", "hash": "90e62895a99863ce7084adae4334a3a6"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "dbf4619ca04c9103b5c6cb1d40c8927e"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "5c79c792ad3e54fdc11beda75bd70701c2bc64d05f55304d6188ac90675fe2ae", "viewCount": 1, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-07-29T11:22:14"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:ghisler:total_commander:7.01"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"osvdb": [{"lastseen": "2017-04-28T13:20:35", "references": [], "description": "# No description provided by the source\n\n## References:\nSecurity Tracker: 1018662\n[Secunia Advisory ID:26734](https://secuniaresearch.flexerasoftware.com/advisories/26734/)\nOther Advisory URL: http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt\nOther Advisory URL: http://www.ghisler.com/whatsnew.htm\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-09/0056.html\nISS X-Force ID: 36487\nISS X-Force ID: 36486\nFrSIRT Advisory: ADV-2007-3102\n[CVE-2007-4756](https://vulners.com/cve/CVE-2007-4756)\nBugtraq ID: 25581\n", "edition": 1, "reporter": "OSVDB", "published": "2007-09-06T12:21:28", "title": "Total Commander FTP Client Traversal Arbitrary File Overwrite", "type": "osvdb", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2007-4756"], "modified": "2007-09-06T12:21:28", "href": "https://vulners.com/osvdb/OSVDB:39838", "id": "OSVDB:39838", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2018-09-01T23:57:05", "references": ["http://www.nessus.org/u?782ae166", "http://www.ghisler.com/whatsnew.htm", "http://seclists.org/bugtraq/2007/Sep/55"], "pluginID": "40927", "description": "The version of Total Commander installed on the remote host fails to sanitize filenames of directory traversal sequences when downloading files via FTP. \n\nIf an attacker can trick a user on the affected system into visiting a malicious FTP server, he can leverage this issue to write to arbitrary files, subject to his privileges.", "edition": 6, "reporter": "Tenable", "published": "2009-09-10T00:00:00", "title": "Total Commander FTP Client Traversal Arbitrary File Overwrite", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Windows", "bulletinFamily": "scanner", "cvelist": ["CVE-2007-4756"], "modified": "2018-08-22T00:00:00", "cpe": [], "id": "TOTAL_COMMANDER_702.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=40927", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(40927);\n script_version(\"1.8\");\n\n script_cve_id(\"CVE-2007-4756\");\n script_bugtraq_id(25581);\n script_xref(name:\"Secunia\", value:\"26734\");\n\n script_name(english:\"Total Commander FTP Client Traversal Arbitrary File Overwrite\");\n script_summary(english:\"Checks if vulnerable version of Total Commander is installed\"); \n \n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host contains an application that is affected by an\narbitrary file overwrite issue.\" );\n\n script_set_attribute(attribute:\"description\", value:\n\"The version of Total Commander installed on the remote host fails to\nsanitize filenames of directory traversal sequences when downloading\nfiles via FTP. \n\nIf an attacker can trick a user on the affected system into visiting a\nmalicious FTP server, he can leverage this issue to write to arbitrary\nfiles, subject to his privileges.\");\n\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?782ae166\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://seclists.org/bugtraq/2007/Sep/55\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.ghisler.com/whatsnew.htm\" );\n\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Total Commander 7.02 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(22);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/09/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/09/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/09/10\");\n\n script_cvs_date(\"Date: 2018/08/22 16:49:14\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"total_commander_installed.nasl\");\n script_require_keys(\"SMB/Totalcommander/Version\");\n script_require_ports(139, 445);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\n\n\nversion_ui = get_kb_item(\"SMB/Totalcommander/Version_UI\");\nversion = get_kb_item(\"SMB/Totalcommander/Version\");\nif (isnull(version)) exit(1,\"The 'SMB/Totalcommander/Version' KB item is missing.\");\n\nif (isnull(version_ui)) version_report = version;\nelse version_report = version_ui;\n\nver = split(version,sep:\".\",keep:FALSE);\nfor (i=0; i<max_index(ver); i++)\n ver[i] = int(ver[i]);\n\n# nb: the issue is also addressed in 6.57, which runs under Windows\n# 3.1 and uses a totally different file name so it won't be\n# reported by total_commander_installed.nasl.\nif (\n ver[0] < 7 ||\n (ver[0] == 7 && ver[1] == 0 && ver[2] < 2)\n)\n{\n port = get_kb_item(\"SMB/transport\");\n if (report_verbosity > 0) \n {\n report = string(\n \"\\n\",\n \"Version \",version_report,\" of Total Commander is installed on the remote host.\",\n \"\\n\"\n );\n security_hole(port:port, extra:report);\n } \t\n else security_hole(port);\n exit(0);\n}\nelse exit(0, \"The host is not affected since Total Commander \"+version_report+\" is installed.\");\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}