PT-2004-3380 · Nexgen · Nexgen Ftp Server

Published 2004-12-31 · Updated 2024-02-14 · CVE-2004-2488

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Nexgen FTP Server versions prior to 2.2.3.23

Description: The issue allows remote authenticated users to read or list arbitrary files via "C:" sequences in the (1) RETR (get), (2) NLST (ls), (3) LIST (ls), (4) RNFR, or (5) RNTO FTP commands. This is a directory traversal vulnerability.

Recommendations: For versions prior to 2.2.3.23, update to version 2.2.3.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected FTP commands until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2004-2488

Affected Products

Nexgen Ftp Server

References · 7

• 🔥 http://securitytracker.com/alerts/2004/Mar/1009545.html · Exploit
• 🔥 http://osvdb.org/4557 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2488 · Security Note
• http://securityfocus.com/bid/9970 · Patch
• http://secunia.com/advisories/11216 · Vendor Advisory
• http://nexgenserver.com/cgi-bin/loadframe2.cgi?/History.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15594 · Note