PT-2017-13959 · Microsoft · Psftpd

Publicado 2017-11-15 · Atualizado 2019-10-03 · CVE-2017-15272

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PSFTPd version 10.0.4 Build 729

Description The issue concerns the storage of configuration data in a Microsoft Access Database file named PSFTPd.dat. This file can be extracted without requiring the password set by the application, which is "ITsILLEGAL". Furthermore, user passwords are stored in cleartext.

Recommendations For PSFTPd version 10.0.4 Build 729, consider changing the way configuration data is stored and securing user passwords to prevent unauthorized access. As a temporary workaround, restrict access to the PSFTPd.dat file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Improper Authentication

Enumeração de Fraquezas

CWE-522

CWE-287

Identificadores relacionados

CVE-2017-15272

Produtos afetados

Psftpd

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-15272 · Aviso do Fabricante
• http://securityfocus.com/archive/1/541518/100/0/threaded · Nota
• https://x41-dsec.de/lab/advisories/x41-2017-006-psftpd · Nota
• http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-15272 · Nota de Segurança