CVE-2007-4756

Description

Directory traversal vulnerability in the FTP client in Total Commander before 7.02 allows remote FTP servers to create or overwrite arbitrary files via "..\" (dot dot backslash) sequences in a filename. NOTE: the "..\" are not displayed when the user lists files. NOTE: this can be leveraged for code execution by writing to a Startup folder.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/36487

https://exchange.xforce.ibmcloud.com/vulnerabilities/36486

http://www.vupen.com/english/advisories/2007/3102

http://www.securitytracker.com/id?1018662

http://www.securityfocus.com/archive/1/478720/100/0/threaded

http://www.ghisler.com/whatsnew.htm

http://securityreason.com/securityalert/3106

http://secunia.com/advisories/26734

http://osvdb.org/39838

http://blog.hispasec.com/lab/advisories/adv_TotalCommander_7_01_Remote_Traversal.txt

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3