Overview
Encrypted File Transfer Program (EFTP) does not properly validate CWD commands, allowing authenticated users to read arbitrary directories and files.
Description
Encrypted File Transfer Program (EFTP) is an implementation of the FTP protocol using 448-bit Blowfish encryption. EFTP allows authenticated users to read arbitrary directories and files on the server through exploitation of a directory traversal vulnerability in the CWD command. |
Impact
Attackers with access to an EFTP account can read arbitrary directories and files on the server. |
Solution
Upgrade Upgrade to EFTP version 2.0.8 .346: |
Vendor Information
413875
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Ertan Kurt for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
Other Information
| CVE IDs: | CVE-2001-1193 |
| Severity Metric: | 1.89 |
| Date Public: | 2001-12-13 |
| Date First Published: | 2002-09-24 |
| Date Last Updated: | 2002-09-24 17:17 UTC |
| Document Revision: | 5 |