PT-2005-4801 · Ghisler · Total Commander

Publicado 2005-12-07 · Atualizado 2017-07-20 · CVE-2005-4066

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Total Commander version 6.53

Description The issue concerns the use of weak encryption in storing FTP usernames and passwords in the WCX FTP.INI file, allowing local users to decrypt the passwords and gain unauthorized access to FTP servers.

Recommendations For version 6.53, consider updating the storage mechanism for FTP credentials to use stronger encryption methods to protect against unauthorized access. As a temporary workaround, restrict access to the WCX FTP.INI file to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2005-4066

Produtos afetados

Total Commander

Referências · 5

• http://networksecurity.fi/advisories/total-commander.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4066 · Nota de Segurança
• http://vupen.com/english/advisories/2005/2780 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23497 · Nota
• http://securitytracker.com/id?1015311 · Aviso do Fabricante