PT-2002-1985 · Microsoft · File Transfer Manager

Published 2002-08-23 · Updated 2008-09-10 · CVE-2002-0978

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft File Transfer Manager (FTM) versions prior to 4.0

Description: The issue allows remote attackers to upload or download arbitrary files to arbitrary locations via a man-in-the-middle attack. This is achieved by modifying the TGT and TGN parameters in a call to the Persist function.

Recommendations: For versions prior to 4.0, update to version 4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Persist function to minimize the risk of exploitation. Avoid using the TGT and TGN parameters in the affected API endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2002-0978

Affected Products

File Transfer Manager

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2002-0978 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2002-08/0189.html · Vendor Advisory