PT-2004-3424 · Rhinosoft · Serv-U Ftp Server

Publicado 2004-12-31 · Atualizado 2020-07-28 · CVE-2004-2532

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Serv-U FTP server versions prior to 5.1.0.0

Description The issue allows local users to execute arbitrary commands by connecting to the server using a default administrator account, creating a new user, logging in as that new user, and then using the SITE EXEC command. This is possible due to a default account and password for local administration.

Recommendations For versions prior to 5.1.0.0, update to version 5.1.0.0 or later to resolve the issue. As a temporary workaround, consider changing the default administrator account password and restricting access to the SITE EXEC command until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2004-2532

Produtos afetados

Serv-U Ftp Server

Referências · 6

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2004-08/0216.html · Exploit
• 🔥 http://securityfocus.com/bid/10886 · Exploit
• 🔥 https://exploit-db.com/exploits/381 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16925 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2532 · Nota de Segurança
• http://osvdb.org/8877 · Nota