Check Point Advisories

Internet Explorer FTP Client Directory Traversal (CVE-2004-1376)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-181
Date Published:	28 Oct 2009
Severity:	High
Last Updated:	Wednesday 27 June, 2018
Source:
Industry Reference:	CVE-2004-1376
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Microsoft Internet Explorer (IE) incorporates an FTP client component that is capable of communicating with standard FTP servers. To invoke the FTP functionality in order to view files on an FTP server, a URI of the ftp:// scheme is used. When no specific file is indicated with the URL such as "ftp://server.com/", the directory listing for the directory will be displayed in the browser. A vulnerability exists in the way Microsoft Internet Explorer handles filenames downloaded via the FTP protocol. Insufficient input validation can allow for the creation of a file in an arbitrary location on the client filesystem. Exploitation of this vulnerability allows an attacker to modify the local content of a target system, potentially resulting in the execution of arbitrary code with the security context of the currently logged in user. If the user uses the "Copy to folder..." method to save the specially crafted file, a "Browse for folder" dialog prompts the user to specify the destination folder. This is normal behaviour for the affected products. If the user uses the "copy and paste" or "drag and drop" method, then no additional user prompts are made. The directory traversal may be visible to the user. However, this may be hidden by using a filename that starts with other characters such as a large number of spaces. In the case of a successful attack, the target will not exhibit any unusual behaviour before or during the malicious file downloading.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Internet Explorer FTP Client Directory Traversal protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: FTP Enforcement Violation.
Attack Information: Internet Explorer FTP Client Directory Traversal