PT-2005-1573 · Argosoft · Argosoft Ftp Server

Publicado 2005-02-18 · Atualizado 2017-07-11 · CVE-2005-0519

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ArGoSoft FTP Server versions prior to 1.4.2.7

Description The issue allows remote attackers to read arbitrary files by uploading a ZIP file containing a shortcut (.LNK) file, using the SITE UNZIP command to extract the .LNK file onto the server, and then accessing the file.

Recommendations For versions prior to 1.4.2.7, update to version 1.4.2.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SITE UNZIP command to minimize the risk of exploitation. Avoid using the SITE UNZIP command with ZIP files containing .LNK files until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-0519

Produtos afetados

Argosoft Ftp Server

Referências · 6

• http://secunia.com/advisories/14172 · Correção
• http://securityfocus.com/bid/12487 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-0519 · Nota de Segurança
• http://osvdb.org/13614 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17939 · Nota
• http://argosoft.com/ftpserver/changelist.aspx · Aviso do Fabricante