Secunia

aT4r ins4n3 has reported a vulnerability in Fastream NETFile FTP/Web Server, which can be exploited by malicious people to retrieve or overwrite arbitrary files.

Input passed to the "filename" parameter isn't properly verified before it is used in various commands. This can be exploited by using two slashes ("..//") in a classical directory traversal attack through various commands to view and overwrite files.

The vulnerability has been reported in version 6.7.2.1085. Prior versions may also be affected.

NOTE: Tan Chew Keong has reported that it is possible to bypass the sanitisation and verification process in version 7.4.6, using e.g. the ".../..//a/.../" character sequence in a directory traversal attack. Other versions may also be affected.

Solution
The vulnerability has been fixed in version 7.5.0 Beta 7.
Further details available in Customer Area

Provided and/or discovered by
Originally reported by:
* aT4r ins4n3

Additional information provided by:
* Tan Chew Keong, SIG^2

Changelog
Further details available in Customer Area

Original Advisory
http://www.haxorcitos.com/Fastream_advisory.txt
http://www.security.org.sg/vuln/netfileftp746.html

Deep Links
Links available in Customer Area