PT-2009-3506 · Proftpd+3 · Proftpd+3

Publicado 2009-03-16 · Atualizado 2017-08-17 · CVE-2009-0919

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XAMPP (affected versions not specified)

Description The issue concerns insecure default passwords in multiple packages installed by XAMPP. This makes it easier for remote attackers to gain access through various default passwords, including the nobody account in ProFTPD, the root account in MySQL, and the pma account in phpMyAdmin. This issue affects any product installed within the XAMPP environment.

Recommendations For XAMPP, change the default passwords for the nobody account in ProFTPD, the root account in MySQL, and the pma account in phpMyAdmin to secure passwords. As a temporary workaround, consider restricting access to the ProFTPD, MySQL, and phpMyAdmin installations until secure passwords are set. Avoid using default or blank passwords for any accounts within the XAMPP environment to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2009-0919

Produtos afetados

Mysql Server

Proftpd

Xampp

Phpmyadmin

Referências · 7

• http://debianhelp.co.uk/xampp.htm · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0919 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49306 · Nota
• http://ibm.com/developerworks/linux/library/l-xampp · Nota
• http://apachefriends.org/en/faq-xampp-linux.html · Nota
• http://ptk.dflabs.com/security.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0919 · Nota de Segurança