CVE-2008-2702

EPSS 10.7%

Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/31887unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://secunia.com/advisories/30559 https://exchange.xforce.ibmcloud.com/vulnerabilities/42900 http://vuln.sg/alftp41b2-en.html http://www.securityfocus.com/bid/29585 http://www.vupen.com/english/advisories/2008/1763/references