PT-2014-4892 · Martin Prikryl · Winscp

Publicado 2014-04-21 · Atualizado 2018-10-09 · CVE-2014-2735

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WinSCP versions prior to 5.5.3

Description The issue arises when using FTP with TLS, as it fails to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This allows attackers to potentially spoof SSL servers via an arbitrary valid certificate.

Recommendations For versions prior to 5.5.3, update to version 5.5.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of FTP with TLS until the update is applied. Restrict access to sensitive data and servers to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-2735

Produtos afetados

Winscp

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-2735 · Nota de Segurança
• http://winscp.net/tracker/show_bug.cgi?id=1152 · Nota
• http://winscp.net/eng/docs/history · Nota
• http://securityfocus.com/archive/1/531847/100/0/threaded · Nota