PT-2004-2845 · Ncftp · Ncftp Client

Konstantin Gavrilenko · Publicado 2004-04-20 · Atualizado 2017-07-11 · CVE-2004-1948

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NcFTP client versions 3.1.6 through 3.1.7

Description The issue allows local users to obtain sensitive information, such as usernames and passwords, when they are included in an FTP URL provided on the command line. This is possible because the URL is displayed in the process list when using commands like "ps aux".

Recommendations For NcFTP client versions 3.1.6 and 3.1.7, avoid including the username and password in the FTP URL when providing it on the command line. As a temporary workaround, consider using alternative methods for authentication that do not expose sensitive information in the process list.

Exploit

Correção

Identificadores relacionados

CVE-2004-1948

Produtos afetados

Ncftp Client

Referências · 9

• 🔥 http://secunia.com/advisories/11438 · Exploit
• http://osvdb.org/5595 · Nota
• http://securityfocus.com/bid/10182 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2004-1948 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15919 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-1948 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=108247943201685&w=2 · Nota
• https://security-tracker.debian.org/tracker/CVE-2004-1948 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1948 · Nota de Segurança