CVE		CVE-2007-0888
Статус		Candidate
Описание		Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// (dot dot) sequences in the pathname argument to an FTP (1) GET or (2) PUT command.
Важность		Medium
CVSS score		4,7
CVSS vector		(AV:R/AC:L/Au:NR/C:P/I:P/A:N/B:N)
Phase		Assigned (12.02.2007)
NVD:		http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0888
References		BID : 22490
		BUGTRAQ : 20070208 TFTP directory traversal in Kiwi CatTools
		BUGTRAQ : 20070213 Re: TFTP directory traversal in Kiwi CatTools
		CONFIRM : http://www.kiwisyslog.com/kb/idx/5/178/article/
		FRSIRT : ADV-2007-0536
		OSVDB : 33162
		SECUNIA : 24103
		XF : kiwicattools-tftp-directory-traversal(32398)
SecurityVulns:		Обратный путь в каталогах TFTP-сервера Kiwi CatTools (directory traversal)