PT-2004-2784 · Ipswitch · Ipswitch Ws Ftp Server

Published 2004-12-31 · Updated 2023-10-11 · CVE-2004-1885

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ipswitch WS FTP Server version 4.0.2

Description The issue allows remote authenticated users to execute arbitrary programs as SYSTEM. This is achieved by using the SITE command to modify certain iFtpSvc options handled by iftpmgr.exe.

Recommendations For Ipswitch WS FTP Server version 4.0.2, consider restricting access to the SITE command until a patch is available. As a temporary workaround, limit the execution of arbitrary programs by modifying the iFtpSvc options to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-1885

Affected Products

Ipswitch Ws Ftp Server

References · 6

• 🔥 http://securityfocus.com/bid/9953 · Exploit
• 🔥 http://secunia.com/advisories/11206 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1885 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15558 · Note
• http://marc.info/?l=bugtraq&m=108006581418116&w=2 · Note
• https://t.me/cvenotify/59268 · Telegram Post