Short Name |
FTP:SERVU:RNTO-TRAV |
---|---|
Severity |
Major |
Recommended |
No |
Recommended Action |
Drop |
Category |
FTP |
Keywords |
Rhino Software Serv-U FTP Server rnto Command Directory Traversal |
Release Date |
2010/10/14 |
Update Number |
1792 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
This signature detects attempts to exploit a known directory traversal vulnerability in the Rhino Software Serv-U FTP Server. It is due to an input validation error in server that does not properly sanitize the rnto command. A successful attack allows authenticated remote attackers to write arbitrary files to any location on the server. Also, the attacker can overwrite any file in the target server, which can cause a denial-of-service condition or allow them to run arbitrary commands on the target.
RhinoSoft Serv-U FTP server is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks. Serv-U FTP server 7.2.0.1 is vulnerable; other versions may also be affected.