CVE-2005-0372 Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
MediumCVSS 5.0
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME gtk | < 2.0.18 | 2.0.18 |
| debian/gftp(Debian:12) | < 2.0.18-1 | 2.0.18-1 |
| debian/gftp(Debian:13) | < 2.0.18-1 | 2.0.18-1 |
| debian/gftp(Debian:14) | < 2.0.18-1 | 2.0.18-1 |
References
- CLSA-2005:957 third-party-advisory vendor-advisory
- DSA-686 patch vendor-advisory
- GLSA-200502-27 patch third-party-advisory vendor-advisory
- MDKSA-2005:050 broken-link vendor-advisory
- RHSA-2005:410 third-party-advisory vendor-advisory
- FEDORA-2005-309 third-party-advisory vdb-entry vendor-advisory
- FEDORA-2005-310 third-party-advisory vdb-entry vendor-advisory
- 12539 patch third-party-advisory vdb-entry
- oval:org.mitre.oval:def:717 broken-link signature vdb-entry
- oval:org.mitre.oval:def:9923 broken-link signature vdb-entry
- Debian Security Tracker CVE-2005-0372 vendor-advisory