COMMAND

    FTGate

SYSTEMS AFFECTED

    FTGate Version 2.1 Web interface Server

PROBLEM

    Ussr  Labs  found  following.   FTGate  has many advanced features
    including:

        - Proxy Support, Kill List, Advanced delivery options, Logging
          Address Mapping...
        - Domain  Aliases,  File  import,  Full  Multithreading,  HTML
          Interface
        - Command Processor, RAS Dial-up/Proxy/LAN support, SmartPop
        - Runs as either an Application or a service
        - POP3 server
        - SMTP server/gateway

    UssrLabs found a FTGate Version 2.1 Web interface Server Directory
    Traversal  Vulnerability  Using  the  string  '../'  in  a URL, an
    attacker can gain read access to any file outside of the  intended
    web-published filesystem directory.   There is not much  to expand
    on this one....  Example:

        http://127.1:8080/../../../autoexec.bat

    to show autoexec.bat.

SOLUTION

    This problem was fixed in the next release v2.2, a long time  ago.
    The SEVENTH v2.2  service release was  released over a  month ago,
    so this bug only effects very old FTGate installations.  To  solve
    this problem  either upgrade  your copy  of FTGate  to the current
    release (for free),  or only bind  the web interface  to 'trusted'
    interfaces.