National Vulnerability Database (CVE-2002-1345)

National Cyber-Alert System Vulnerability Summary: CVE-2002-1345
Orirignal release date: 2002-12-23 Source: US-CERT/NIST ### Overview Directory traversal vulnerabilities in multiple FTP clients on UNIX systems allow remote malicious FTP servers to create or overwrite files as the client user via filenames containing /absolute/path or .. (dot dot) sequences. ### Impact CVSS Severity: 3.3 (Low) Range: remote Authentication: input Impact Type: int ### Reference to Advisories, Solutions, and Tools External Source: The Aims Group Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: CERT Name: Multiple FTP clients contain directory traversal vulnerabilities Hyperlink: http://www.kb.cert.org/vuls/id/210409 External Source: Security Focus Name: bid 6360 Hyperlink: http://online.securityfocus.com/bid/6360 External Source: SGI Name: 20021205-01-A Hyperlink: ftp://patches.sgi.com/support/free/security/advisories/20021205-01-A External Source: VULNWATCH Name: 20021210 Directory Traversal Vulnerabilities in FTP Clients Hyperlink: http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0102.html External Source: BID Name: 6360 Hyperlink: http://www.securityfocus.com/bid/6360 External Source: XF Name: ftp-client-filename-traversal(10821) Hyperlink: http://www.iss.net/security_center/static/10821.php ### Vulnerable Software and Vendor NcFTP (NcFTP Software) Solaris (Sun) OpenBSD (OpenBSD) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1345