gFTP: Directory traversal vulnerability — GLSA 200502-27

gFTP is vulnerable to directory traversal attacks, possibly leading to the creation or overwriting of arbitrary files.

Affected packages

Background

gFTP is a GNOME based, multi-threaded file transfer client.

Description

gFTP lacks input validation of filenames received by remote servers.

Impact

An attacker could entice a user to connect to a malicious FTP server and conduct a directory traversal attack by making use of specially crafted filenames. This could lead to arbitrary files being created or overwritten.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-ftp/gftp-2.0.18-r1"

References

• gFTP Announcement
• CAN-2005-0372

Release date
February 19, 2005

Latest revision
February 19, 2005: 01

Severity
normal

Exploitable
remote

Bugzilla entries

• 81994