FTP: ".%20" Directory

This signature detects ".%20" FTP commands sent to FTP/21. The symbol pair %20 (which translates to a space in Web browsers) removes the preceding period, enabling directory traversal. Attackers can be attempting to reveal the full FTP root path.

Extended Description

FTP Serv-U is an internet FTP server from CatSoft. Authenticated users can gain access to the ftproot of the drive where Serv-U FTP has been installed. Users that have read, write, execute and list access in the home directory will have the same permissions to any file which resides on the same partition as the ftproot, once a user is in the home directory they can successfully transfer any files using specially crafted GET requests. All hidden files will be revealed even if the 'Hide hidden files' feature is on. Successful exploitation of this vulnerability could enable a remote user to gain access to systems files, password files, etc. This could lead to a complete compromise of the host.

Affected Products

Cat_soft serv-u

Short Name
FTP:DIRECTORY:DOT-PCT-20-DOT
Severity
Minor
Recommended
False
Recommended Action
None
Category
FTP
Keywords
".%20" CVE-2001-0054 Directory bid:2052
Release Date
04/22/2003
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3375
False Positive
Unknown
Vendors

Cat_soft

CVSS Score

5.0

Found a potential security threat?