[NEWS] Directory Traversal Vulnerabilities in FTP Clients

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion Beyond Security would like to welcome Tiscali World Online to our service provider team. For more info on their service offering IP-Secure,...

Multiple FTP clients contain directory traversal vulnerabilities

Overview Multiple File Transfer Protocol FTP clients contain directory traversal vulnerabilities that allow a malicious FTP server to overwrite files on the client host. Description In a typical file transfer operation, one participant the client requests a file while a second participant the...

CVE-2002-0768

Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0, and possibly other operating systems, allows a malicious FTP server to execute arbitrary code via a long PASV command...

CVE-2002-0608

Buffer overflow in Matu FTP client 1.74 allows remote FTP servers to execute arbitrary code via a long "220" banner...

CVE-2002-0600

Heap overflow in the KTH Kerberos 4 FTP client 4-1.1.1 allows remote malicious servers to execute arbitrary code on the client via a long response to a passive PASV mode request...

CVE-2002-0600

The CVE-2002-0600 entry concerns a heap overflow in the KTH Kerberos 4 FTP client 4-1.1.1. An attacker-controlled long response to a PASV (passive) FTP command can cause a heap overflow, enabling remote code execution on the client. Impact per NVD is high (CVSSv2: base score 7.5) with network att...

CVE-2002-0600

Heap overflow in the KTH Kerberos 4 FTP client 4-1.1.1 allows remote malicious servers to execute arbitrary code on the client via a long response to a passive PASV mode request...

CVE-2002-0608

The vulnerability CVE-2002-0608 concerns the Matu FTP client 1.74, where a buffer overflow in handling the FTP server banner (a long “220” response) can allow the remote FTP server to execute arbitrary code. This is documented in the NVD/NVD-derived records, with the affected component being the ...

CVE-2002-0608

Buffer overflow in Matu FTP client 1.74 allows remote FTP servers to execute arbitrary code via a long "220" banner...

Buffer overflow in Kerberos 4 ftp client

Heap overflow on long server reply...

A bug in the Kerberos4 ftp client may cause heap overflow which leads to remote code execution

Kerberos4 ftp client is a simple ftp client, with the extensions defined by RFC 2228. When authentication fails with AUTH, client will use USER/PASS command as other ones. A bug in the code may cause a heap overflow which leads to remote code execution. The overflow occurs when the server respond...

CVE-1999-1290

Buffer overflow in nftp FTP client version 1.40 allows remote malicious FTP servers to cause a denial of service, and possibly execute arbitrary commands, via a long response string...

CVE-1999-1333

automatic download option in ncftp 2.4.2 FTP client in Red Hat Linux 5.0 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the names of files that are to be downloaded...

CVE-1999-1290

CVE-1999-1290 affects the nftp FTP client (version 1.40). A buffer overflow is triggered by a long response string from a remote FTP server, enabling a denial of service and possibly arbitrary command execution. The provided documents describe the vulnerability and impact but do not specify explo...

CVE-1999-1333

CVE-1999-1333 affects ncftp 2.4.2 and earlier on Red Hat Linux 5.0 and earlier. The automatic download option can be abused by remote attackers to execute arbitrary commands via shell metacharacters in the names of files to be downloaded. The provided documents do not specify a remediation versio...

CVE-1999-1562

gFTP FTP client 1.13, and other versions before 2.0.0, records a password in plaintext in 1 the log window, or 2 in a log file...

CVE-1999-1562

The CVE-1999-1562 entry concerns gFTP, affected versions 1.13 and all before 2.0.0, which may log a user password in plaintext either in the GUI log window or in a log file. This is a plaintext credential exposure vulnerability in the logging path. Debian’s advisory (DSA-084-1) notes a fix in ver...

UltraEdit 8.2 - FTP Client Weak Password Encryption

UltraEdit 8.2 - FTP Client Weak Password Encryption source: https://www.securityfocus.com/bid/3234/info UltraEdit is a multi-featured commercial text editor with support for HTML, C/C++, VB, Java, Perl, XML, and C. It also includes a hex editor and a small FTP client. UltraEdit's FTP client has a...

UltraEdit 8.2 - FTP Client Weak Password Encryption

source: https://www.securityfocus.com/bid/3234/info UltraEdit is a multi-featured commercial text editor with support for HTML, C/C++, VB, Java, Perl, XML, and C. It also includes a hex editor and a small FTP client. UltraEdit's FTP client has a feature which will remember FTP passwords for later...

CVE-1999-0843

CVE-1999-0843 describes a denial-of-service in Cisco routers performing NAT. The vulnerability can be triggered by an FTP client issuing a PORT command directed at a Telnet port, causing the device to basicly become unavailable (DoS). Connected sources identify Cisco routers with NAT as affected ...