ftgate.web.txt

`FTGate Version 2.1 Web interface Server Directory Traversal Vulnerability  
  
Product:  
  
FTGate Version 2.1  
FTGate has many advanced features including:  
- Proxy Support , Kill List , Advanced delivery options, Logging ,  
Address Mapping-  
- Domain Aliases, File import , Full Multithreading, HTML Interface  
- Command Processor, RAS Dial-up/Proxy/LAN support, SmartPop  
- Runs as either an Application or a service  
- POP3 server.  
- SMTP server/gateway  
  
  
PROBLEM  
  
UssrLabs found a FTGate Version 2.1 Web interface Server Directory Traversal  
Vulnerability  
Using the string '../' in a URL, an attacker can gain read access to  
any file outside of the intended web-published filesystem directory  
  
There is not much to expand on this one....  
  
Example:  
  
http://127.1:8080/../../../autoexec.bat to show autoexec.bat  
  
  
Vendor Status:  
no contacted  
  
Vendor Url: http://www.floosietek.com  
Program Url: http://www.floosietek.com/ftgatehome.htm  
  
Credit: USSRLABS  
  
SOLUTION  
  
Nothing yet.  
  
  
`