CVE-2008-2519

Current Description

Directory traversal vulnerability in Core FTP client 2.1 Build 1565 allows remote FTP servers to create or overwrite arbitrary files via .. (dot dot) sequences in responses to LIST commands, a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.

Basic Data

PublishedJune 03, 2008
Last ModifiedAugust 08, 2017
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-22
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score6.8
SeverityMEDIUM
Exploitability Score8.6
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegetrue

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationCore FtpCore Ftp2.1BUILD_1565le*****
    2.3ApplicationCore FtpCore Ftp2.1BUILD_1565pro*****

Vulnerable Software List

VendorProductVersions
Core Ftp Core Ftp 2.1

References

NameSourceURLTags
30389http://secunia.com/advisories/30389SECUNIAVendor Advisory
http://vuln.sg/coreftp211565-en.htmlhttp://vuln.sg/coreftp211565-en.htmlMISCExploit
http://www.coreftp.com/forums/viewtopic.php?t=6078http://www.coreftp.com/forums/viewtopic.php?t=6078CONFIRMPATCH
29362http://www.securityfocus.com/bid/29362BID
ADV-2008-1643http://www.vupen.com/english/advisories/2008/1643/referencesVUPEN
coreftp-list-directory-traversal(42605)https://exchange.xforce.ibmcloud.com/vulnerabilities/42605XF