source: http://www.securityfocus.com/bid/280/info
A vulnerability in Floosietek's FTGate allows remote malicious users to steal local files.
Floosietek's FTGate is a Win32 mail server program. One of its features is allowing administrators to check the status of the mail server using a web browser via a built-in web server.
The web server fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename.
http://www.example.com:8080/../newuser.txt
FTGate contains a flaw that allows a remote attacker to access arbitrary files outside of the web path. The issue is due to the server not properly sanitizing user input, specifically traversal style attacks (../../) supplied via the URI.
-
时间线
1999-05-26
Unknow
1999-05-26
Unknow
-
解决方案
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.
Floosietek no longer supports this product.
活着就是为了改变世界，难道还有其他原因吗？