Cerberus FTP Server Multiple XSS vulnerabilities

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Home
Ask the Team
Mailing Lists
Advertising Info
Advisories
About SecuriTeam
Blogs

Brought to you by:

Suppliers of:

SecuriTeam in Your Inbox

New vulnerability?
New tool?
Tell us
(Our PGP key).

Confidence 2013

5% Off any SANS course
Use Code: SecuriTeam_5

Hack In Paris

La Nuit du Hack

Subjects of Interest:
Vulnerability Management
SQL Injection
Buffer Overflows
Active Network Scanning
Fuzzing
Fuzzer Report
Network Security
Network Scanner
Pen Testing
Security Scanner

Cerberus FTP Server is prone to a Multiple Cross-site Scripting vulnerabilities

Credit:

Free Website Security Scan	Free Fuzzer Report	Vulnerability Assessment
Detect web app vulnerabilities	University study comparing the top	Accurate and automated scanning
Get guidance from professionals.	6 commercially availble fuzzers.	for networks of any size.

Protect your website!
Free Trial, Nothing to install.
No interruption of visitors.
www.beyondsecurity.com/vulnerability-scanner

Vulnerable Systems:
* Cerberus FTP Server <= 5.0.5.1

It was discovered that the Web Administration interface has multiple persistent Cross Site Scripting (XSS) vulnerabilities. In the log
viewer there is a XSS vulnerability which may be used by an unauthenticated user against an authenticated user. In the server
manager a trivial XSS vulnerability exists which may be used by the authenticated user.

To start, the vulnerabilities in the on the "/servermanger" page is trivial to exploit by escaping the "

" tags for each
<br />
available server message.
<br />

<br />
The "/log" is less trivial to exploit in that the log page uses async-javascript callbacks to collect and display log data to the
<br />
user. The log clears itself in 2-3 seconds as well. This occurs normally on an 8 second cycle and I in my experience it was difficult
<br />
to have the log populated with appropriate attack vectors during a window to achieve exploitation.
<br />

<br />
I believe an administrative user would have to be logged in at the time of the attack and actively viewing the "/log" page to achieve
<br />
successful exploitation. Due to these limitations I believe this to have a significant effect on the impact and reliability on any possible exploit code.
<br />

<br />
For more discussion on these bugs I've created a brief write-up at:
<br />
http://sadgeeksinsnow.blogspot.com/2012/12/persistence-is-key-another-bug-hunt.html
<br />

<br />
<B>CVE Information:</B>
<br />
<A HREF="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6339">CVE-2012-6339</A>
<br />

<br />
<B>Disclosure Timeline:</B>
<br />
12/05/2012 - Discovered multiple bugs in product vendor's application
<br />
12/06/2012 - Disclosure of details to product vendor
<br />
12/07/2012 - Vendor created fixes for reported bugs
<br />
12/13/2012 - CVE Assignment
<br />
12/19/2012 - Public disclosure to Bugtraq
       </TD>
      </TR>
     <TR>
        <TD CLASS="header" STYLE="background: #8a8ce2; color: #FFF;"><A NAME="Comments"> </A>Comments:</TD>
      </TR>
	  <TR>
	   <TD>
<div id="disqus_thread"></div>
<script type="text/javascript">
/* * * CONFIGURATION VARIABLES: EDIT BEFORE PASTING INTO YOUR WEBPAGE * * */
var disqus_shortname = 'mainsecuriteam'; // required: replace example with your forum shortname

// The following are highly recommended additional parameters. Remove the slashes in front to use.
var disqus_identifier = '6B03I206AA';
var disqus_url = 'http://www.securiteam.com/securitynews/6B03I206AA.html';

/* * * DON'T EDIT BELOW THIS LINE * * */
(function() {
 var dsq = document.createElement('script'); dsq.type = 'text/javascript'; dsq.async = true;
 dsq.src = 'http://' + disqus_shortname + '.disqus.com/embed.js';
 (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq);
})();
</script>
<noscript>Please enable JavaScript to view the <a href="http://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>
<a href="http://disqus.com" class="dsq-brlink">blog comments powered by <span class="logo-disqus">Disqus</span></a>
</TD>
     </TABLE>
   </TD>
   </TR>
  </TABLE>
 </TD>
  
 <TD ID="RightSidebar" VALIGN=TOP CLASS="fd" WIDTH="20%">
  <TABLE ID="RightSidebarTable" WIDTH="100%" BORDER=0>
   <TR>
    <TD ID="SearchSecuriTeam">
      <TABLE ID="SearchTABLE" BORDER=0 CELLSPACING=0 CELLPADDING=0>
      <TR>
      <TD>
       <form method="POST" action="/cgi-bin/htsearch">
       <input name="words" type="Text" value="Search" maxlength="100" size="20"><BR>
       <input type="hidden" name="method" value="and">
     <input type="hidden" name="format" value="builtin-long">
     <input type="hidden" name="sort" value="score">
      <select name="restrict">
      <option value="">All Sections
      <option value="/securitynews/">Security News
      <option value="/unixfocus/">Unix focus
      <option value="/exploits/">Exploits
      <option value="/tools">Tools
      <option value="/windowsntfocus">Windows focus
      <option value="/securityreviews">Security Reviews
      </select>
      <input type="hidden" name="exclude" value="">
      <INPUT TYPE="image" SRC="/images/search-whitebg.gif" ALT="Search"></FORM>
     </TD>
      </TR>
     </TABLE>
     </TD>
   </TR>
   <TR>
  <TD ID="ToolsExploitsFeaturedLinks" VALIGN=TOP CLASS="fd" WIDTH="20%">
   <TABLE ID="ToolsExploitsFeaturedLinksTable" WIDTH="100%">

    <TR>
     <TD CLASS="headersidebar" STYLE="border: 1px solid #8a8ce2"> Related Articles</TD>
    </TR>
    <TR>
     <TD CLASS="sidebarframe" STYLE="padding: 2px;">
      <TABLE CLASS="rightsidebar" ALIGN="LEFT">
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/7G52V1P9FY.html">Moodle WebDav Repository Plaintext Password Disclosure Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/6Q03R0A95A.html">QuickShare File Share Directory Traversal Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/6P03Q0A95A.html">ELinks Security Bypass Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/6O0360A95A.html">BlazeDVD PLF Exploit DEP/ASLR Bypass (MSF) Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5PP2V2KA2A.html">WebKit Web Audio Channel Handling Race Condition Buffer Overflow Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5OP2U2KA2A.html">Verax NMS Console AMF Response Plaintext Connection Information Disclosure Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5HP342KA1A.html">Simeji for Android Application Handling Information Disclosure Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5GP332KA1A.html">Ptlib Entity Expansion Recursion XML Nested Entity Handling DoS Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5FP322KA1A.html">ownCloud /core/settings/ajax/setquota.php quota Parameter XSS Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5EP312KA1A.html">Nitro Pro PDF File Handling DoS Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5PP2W2KA1A.html">MailOrderWorks Dispatch Order Multiple Field XSS  Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5OP2V2KA1A.html">Linux Kernel Dccp Subsystem Ccid Null Pointer Dereference Local DoS Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5NP2U2KA1A.html">ISC DHCP libdns Unspecified Remote Memory Exhaustion DoS Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5GP342KA0A.html">GroundWork Monitor Enterprise Noma Component Multiple XSS  Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5FP332KA0A.html">GroundWork Monitor Enterprise Foundation Admin Interface XSS  Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5EP322KA0A.html">Google Chrome Isolated Web Sites Process Handling Issue Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5DP312KA0A.html">Google Android On Samsung Unprivileged Arbitrary SMS Message Sending Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5CP302KA0A.html">FFmpeg Libavcodec/error Function NULL Pointer Dereference DoS Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5QP2Y2KA0A.html">Commons Groups Module for Drupal Group Access Restriction Bypass Vulnerability</a></TD>
       </TR>
       
  	   <TR>
 	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5PP2X2KA0A.html">Cfingerd RFC1413 (Ident) Client Remote Overflow Vulnerability</a></TD>
       </TR>
       
      </TABLE>
      <BR>
     </TD>
    </TR>
	<TR><TD><BR></TD></TR>
    <TR>
     <TD CLASS="headersidebar" STYLE="border: 1px solid #8a8ce2"> Featured Articles</TD>
    </TR>
    <TR>
     <TD CLASS="sidebarframe" STYLE="padding: 2px;">
      <TABLE CLASS="rightsidebar" ALIGN="LEFT">
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5UP312AA1A.html">Mozilla Multiple Product HTML Editor Function Use-after-free Arbitrary Code Execution Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5NP330UA0A.html">Exim with Dovecot Typical Misconfiguration Leads to Remote Command Execution Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5AP300KA0A.html">IBM InfoSphere Information Server Unspecified Arbitrary Site Redirect Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5CP2W0AA0A.html">Cisco Unity Express /Web/SA2/ScriptList.do gui_pagenotableData Parameter XSS Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5BP3J2K9QS.html">Supportworks ITSM SQL Injection Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5KP3O1P9QY.html">WirelessFiles for iPad/iPhone Multiple File Extension Upload Arbitrary Script Code Execution Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5DP3H159RI.html">IBM InfoSphere Information Server Import Export Manager Path Subversion Arbitrary DLL Injection Code Execution Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5BP3H159PE.html">CommentLuv Plugin for WordPress /wp-admin/admin-ajax.php _ajax_nonce Parameter XSS Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5GP352K9QC.html">ownCloud Multiple Script Multiple Administrator Action CSRF Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5ZP3E1P9PM.html">IBM Multiple Product XSS Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5OP3C1F9QQ.html">TLS / DTLS Protocol CBC-Mode Ciphersuite Distinguishing Attack Information Disclosure Weakness Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5EP342K9PA.html">JBoss Enterprise Application Platform / JBoss Enterprise Web Platform JMX Invoker Roll Restriction Weakness Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5FP32159PK.html">Google AD Sync Tool Exposure Of Sensitive Information Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5BP320K9QS.html">VMware Multiple Product vmci.sys VMCI Control Code Handling Local Privilege Escalation Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5CP2Y0A9PA.html">Cisco Unity Express /Web/SA/SaveConfiguration.do Multiple Action CSRF Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5MP3G209FS.html">AdPeeps /adpeeps_servlet.php Bannertext Parameter XSS Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5VP3J1P9GQ.html">Oracle Application Framework Diagnostic Mode Bypass Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5FP3J0A9GA.html">Nero MediaHome NMMediaServer.dll Long Request Line Off-By-One Overflow Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5MP3G009HO.html">Samba Samba Web Administration Tool (SWAT) Manipulation CSRF Vulnerability</a></TD>
       </TR>
       
       <TR>
	    <TD STYLE="vertical-align: top"><IMG SRC="/images/block.png" ALT=">"></TD>
        <TD><a class="sidebarlink" href="/securitynews/5WP362K9FY.html">Adobe Flash Player And AIR  Context Dependent Attacker Buffer Overflow Vulnerability</a></TD>
       </TR>
       
      </TABLE>
      <BR>
     </TD>
    </TR>

</TABLE>
 </TD>
 </TABLE>
 </TD>
 </TR>

<TR ID="ContentSectionsBottom">
  <TD> </TD>
   <TD CLASS="ArticleSection" STYLE="text-align: center;"><HR STYLE="margin-left: auto; margin-right: auto"><A HREF="/securitynews/">Security News</a> - <A HREF="/securityreviews/">Security Reviews</a> - <A HREF="/exploits/">Exploits</a> - <A HREF="/tools/">Tools</a> - <A HREF="/unixfocus/">UNIX Focus</a> - <A HREF="/windowsntfocus/">Windows Focus</a> - <A HREF="http://blogs.securiteam.com/" STYLE="white-space: nowrap">Blogs</a> - <A HREF="/cves/" STYLE="white-space: nowrap">CVEs <img border="0" src="/images/new.gif"></a></TD>
   <TD> </TD>
   </TR>

</TABLE>
</DIV>

<HR STYLE="width: 100%; height: 1pt; color: #005a9c; border-bottom-width: 1px; border-top-width: 0px;">
<P ALIGN="CENTER" STYLE="color: gray; font-size: 8pt;">
Copyright © <A HREF="http://www.beyondsecurity.com/" STYLE="color: gray; font-size: 8pt;">Beyond Security®</A> All rights reserved.<BR>
<A HREF="http://www.beyondsecurity.com/legal.html" STYLE="color: gray; font-size: 8pt;">Terms of Use</A> <A HREF="http://www.beyondsecurity.com/privacy.html" style="color: gray; font-size: 8pt;">Site Privacy Statement</A>.<BR>
SecuriTeam™ is a trademark of Beyond Security®</P>

var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-29522810-1']);
  _gaq.push(['_setDomainName', 'securiteam.com']);
  _gaq.push(['_trackPageview']);

(function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();

</script>
<div id="k_close_button" class="k_float kc_bottom kc_right"></div><div><a href="http://www.kampyle.com/free-feedback-form/"  target="kampyleWindow" id="kampylink" class="k_float k_bottom_sl k_right" onclick="javascript:k_button.open_ff('site_code=6636876&form_id=38362&lang=en');return false;"><img src="http://cf.kampyle.com/buttons/en/orange/en-orange-corner-low-right.gif" alt="Feedback Form" border="0"/></a></div><div id="k_slogan" class="k_float k_bottom k_right"><a href="http://www.kampyle.com/" target="_blank">Feedback</a> Analytics</div><script src="http://cf.kampyle.com/k_button.js" type="text/javascript"></script>
<script type="text/javascript" src="http://cf.kampyle.com/k_push.js"></script>

</BODY>
</HTML>