Description
Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via "..\" (dot dot backslash) sequences in a filename. NOTE: the "..\" are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.
References
- 20070906 [HISPASEC] 2K7SEPT6 Total Commander 7.01 Remote FTP Client Directory Traversal mailing-list
- 26734 third-party-advisory
- 39838 vdb-entry
- http://www.ghisler.com/whatsnew.htm
- 25581 vdb-entry
- 3106 third-party-advisory
- http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt
- totalcommander-ftp-weak-security(36487) vdb-entry
- ADV-2007-3102 vdb-entry
- 1018662 vdb-entry
- totalcommander-ftp-directory-traversal(36486) vdb-entry