PT-2004-2845 · Ncftp · Ncftp Client

Konstantin Gavrilenko · Published 2004-04-20 · Updated 2017-07-11 · CVE-2004-1948

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NcFTP client versions 3.1.6 through 3.1.7

Description The issue allows local users to obtain sensitive information, such as usernames and passwords, when they are included in an FTP URL provided on the command line. This is possible because the URL is displayed in the process list when using commands like "ps aux".

Recommendations For NcFTP client versions 3.1.6 and 3.1.7, avoid including the username and password in the FTP URL when providing it on the command line. As a temporary workaround, consider using alternative methods for authentication that do not expose sensitive information in the process list.

Exploit

Fix

Related Identifiers

CVE-2004-1948

Affected Products

Ncftp Client

References · 9

• 🔥 http://secunia.com/advisories/11438 · Exploit
• http://securityfocus.com/bid/10182 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-1948 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-1948 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-1948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1948 · Security Note
• http://osvdb.org/5595 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15919 · Note
• http://marc.info/?l=bugtraq&m=108247943201685&w=2 · Note