PT-1997-1225 · Freebsd · Freebsd

Publicado 1997-04-07 · Atualizado 2008-09-10 · CVE-1999-1298

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD versions 2.2.1 and earlier

Description The issue concerns the configuration of anonymous FTP by Sysinstall. When this configuration is set up, it creates an ftp user without a password and assigns /bin/date as the shell. This setup could potentially allow attackers to access certain system resources.

Recommendations For versions 2.2.1 and earlier, consider setting a strong password for the ftp user and changing the shell assignment to a more secure option to prevent unauthorized access. As a temporary workaround, restrict access to the ftp user account until a more permanent solution can be applied.

Correção

Identificadores relacionados

CVE-1999-1298

Produtos afetados

Freebsd

Referências · 4

• http://iss.net/security_center/static/7537.php · Nota
• http://osvdb.org/6087 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-1999-1298 · Nota de Segurança
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-97:03.sysinstall.asc · Aviso do Fabricante