Pablo Sofware Solutions FTP server Directory Traversal Vulnerability
Pablo Software Solutions FTP server version 1.0 build 9 shows files and
directories that reside outside the normal FTP root directory.
Pablo's FTP Server is a multi threaded FTP server for Windows 98/NT/XP.
It comes with an easy to use interface and can be accessed from the system
The server handles all basic FTP commands and offers easy user account
management and support for virtual directories.
This FTP server can shows file and directory content that reside outside the
The vulnerability can be done using the MS-DOS ftp client. When you are
logged on the server, you can send a dir \..\, or a dir \..\WINNT, supposed
The vendor has been informed and has solved the problem.
Download Pablo's FTP Server Build 10 at :

by example.com (Postfix, from userid 500)
	id 6798116F23; Tue,  3 Sep 2002 14:38:29 +0100 (IST)
from example.com (localhost [127.0.0.1])
	by jmason.org (Postfix) with ESMTP
	id 6221BF7A7; Tue,  3 Sep 2002 14:38:29 +0100 (IST)
quinlan@pathname.com, yyyy@example.com (Justin Mason),
	spamassassin-devel@lists.sourceforge.net
Message from "Craig R.Hughes" <craig@deersoft.com> 
   of "Mon, 02 Sep 2002 22:37:10 PDT." <312D1C89-BEFF-11D6-9DD0-00039396ECF2@deersoft.com>
No, hits=-12.2 required=7.0
	tests=AWL,HABEAS_SWE,IN_REP_TO,QUOTED_EMAIL_TEXT,
	      SPAM_PHRASE_02_03
	version=2.41-cvs
From jm@jmason.org  Tue Sep  3 14:38:29 2002

"Craig R.Hughes" said:
> Seems like a good idea.  We might get one of two other issues
> raised tomorrow too once US people get back to work tomorrow and
> start downloading 2.40 in earnest.
yep, I reckon that's likely.
BTW I'm hearing reports about problems resolving spamassassin.org.
Anyone else noticing this?  if it's serious I'll see if I can get
Mark Reynolds to add a 2ndary in the US, to go with the primaries
in Oz.
> >    - looks like there may be a razor2 issue
I think this is a Razor bug/glitch triggered when file permissions
don't allow its own log system to work.  At least that's the report
I heard on the Razor list in the past...
Theo, does it work now that you /dev/null'd the logfile?
> >    - version number (says "cvs")
> >    - tag tree as "Rel" this time too
I won't bother tagging with Rel, IMO; I don't think we should
rely on the version control system inside our code, so I've just
put a line in Mail/SpamAssassin.pm instead.   I will of course
tag with a release *label* though.
--j.