PT-2005-5338 · Ioftpd · Ioftpd

Publicado 2005-12-31 · Atualizado 2008-09-05 · CVE-2005-4673

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ioFTPD version 0.5.84 u

Description The issue allows remote attackers to enumerate valid usernames by analyzing different response messages from the software, depending on whether a username exists or not.

Recommendations For ioFTPD version 0.5.84 u, consider modifying the response mechanism to prevent differentiation in messages based on username existence, thereby mitigating the risk of username enumeration.

Correção

Identificadores relacionados

CVE-2005-4673

Produtos afetados

Ioftpd

Referências · 5

• http://critical.lt/?vulnerabilities/119 · Aviso do Fabricante
• http://osvdb.org/22709 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4673 · Nota de Segurança
• http://securityfocus.com/bid/15253 · Nota
• http://security.nnov.ru/Kdocument79.html · Aviso do Fabricante