Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-1117

Overview

Vulnerability Score 10.0 10.0
CVE Id CVE-2008-1117
Last Modified 07 Mar 2011 10:05:58
Published 14 Mar 2008 04:44:00
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2008-1117

Summary

Directory traversal vulnerability in the Notes (aka Flash Notes or instant messages) feature in tb2ftp.dll in Timbuktu Pro 8.6.5 for Windows, and possibly 8.7 for Mac OS X, allows remote attackers to upload files to arbitrary locations via a destination filename with a \ (backslash) character followed by ../ (dot dot slash) sequences. NOTE: this can be leveraged for code execution by writing to a Startup folder. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4220.

Vulnerable Systems

Application

  • Netopia Timbuktu Pro 8.6.5


References

VUPEN - ADV-2008-0840

BID - 28081

BUGTRAQ - 20080311 CORE-2008-0204: Timbuktu Pro Remote Path Traversal and Log Injection

BUGTRAQ - 20080311 Re: [Full-disclosure] Vulnerabilities in Timbuktu Pro 8.6.5

BUGTRAQ - 20080310 Vulnerabilities in Timbuktu Pro 8.6.5

MILW0RM - 5238

MILW0RM - 4455

MISC - http://www.coresecurity.com/?action=item&id=2166

SREASON - 3741

SECUNIA - 29316

MISC - http://aluigi.org/poc/timbuto.zip

MISC - http://aluigi.altervista.org/adv/timbuto-adv.txt


Last Updated: 27 May 2016 10:47:02