PT-2008-2229 · Xlight · Xlight Ftp Server

Publicado 2008-02-06 · Atualizado 2008-09-05 · CVE-2008-0604

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XLight FTP Server versions prior to 2.83

Description The issue concerns the LDAP authentication feature, which fails to check for blank passwords when used with certain LDAP servers. This allows remote attackers to bypass intended access restrictions.

Recommendations For versions prior to 2.83, update to version 2.83 or later to resolve the issue. As a temporary workaround, consider disabling the LDAP authentication feature until the update is applied. Restrict access to the LDAP authentication module to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2008-0604

Produtos afetados

Xlight Ftp Server

Referências · 4

• http://secunia.com/advisories/28755 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-0604 · Nota de Segurança
• http://securityfocus.com/bid/27602 · Correção
• http://xlightftpd.com/whatsnew.htm · Nota