PT-2014-4185 · Core Ftp · Core Ftp Server

Publicado 2014-05-02 · Atualizado 2014-05-02 · CVE-2014-1443

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Core FTP Server version 1.2 before build 515

Description The issue allows remote authenticated users to obtain sensitive information, specifically the password for the previous user, by sending a USER command with a specific length. This could be related to an out-of-bounds read.

Recommendations For Core FTP Server version 1.2 before build 515, update to build 515 or later to resolve the issue. As a temporary workaround, consider restricting access to the USER command to minimize the risk of exploitation.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2014-1443

Produtos afetados

Core Ftp Server

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2014/Feb/39 · Exploit
• 🔥 http://packetstormsecurity.com/files/125073/Core-FTP-Server-1.2-DoS-Traversal-Disclosure.html · Exploit
• http://osvdb.org/102968 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1443 · Nota de Segurança
• http://secunia.com/advisories/56850 · Aviso do Fabricante
• http://coreftp.com/forums/viewtopic.php?t=2985707 · Aviso do Fabricante