PT-2023-29452 · Netbsd · Ftpd

Publicado 2023-10-05 · Atualizado 2023-10-11 · CVE-2023-45198

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ftpd versions prior to 20230930 tnftpd versions prior to 20231001

Description The issue allows information about the host filesystem to be leaked before authentication via an MLSD or MLST command.

Recommendations For ftpd versions prior to 20230930, update to NetBSD-ftpd 20230930 or later. For tnftpd versions prior to 20231001, update to version 20231001 or later. As a temporary workaround, consider restricting access to the MLSD and MLST commands until a patch is available.

Correção

Identificadores relacionados

CVE-2023-45198

Produtos afetados

Ftpd

Referências · 7

• https://twitter.com/VulmonFeeds/status/1709882904870826405 · Publicação no Twitter
• https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/18 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-45198 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-45198 · Aviso do Fabricante
• https://t.me/cvenotify/59033 · Publicação no Telegram
• http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95 · Correção