Sow Ching Shiong has discovered some vulnerabilities in SnugServer, which can be exploited by malicious users to disclose potentially sensitive information or manipulate certain data.

The vulnerabilities are caused due to input sanitation errors within the FTP service when handling e.g. the "STOR", "RETR", "MKD", "RMD", "DELE", "RNFR", "RNTO", "MDTM", and "SIZE" commands. This can be exploited to e.g. disclose certain system information, download or upload arbitrary files, rename files, and create and delete directories outside the FTP root via directory traversal sequences.

Successful exploitation of certain commands may require that the attacker has write or delete permissions to e.g. a folder within the FTP root.

The vulnerabilities within the handling of the "STOR" and "RETR" commands are confirmed in version 4.3.0.126. Vulnerabilities within the handling of "MKD", "RMD", and "DELE" commands are reported in version 4.3.0.128 and confirmed in version 4.3.0.131. Vulnerabilities within the handling of the "RNFR", "RNTO", "MDTM", and "SIZE" commands are confirmed in version 4.3.0.131.

Solution
Update to version 4.3.0.134.

Provided and/or discovered by
Sow Ching Shiong, reported via Secunia.

Additional information provided by Secunia Research.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area