PT-2005-1573 · Argosoft · Argosoft Ftp Server

Published 2005-02-18 · Updated 2017-07-11 · CVE-2005-0519

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ArGoSoft FTP Server versions prior to 1.4.2.7

Description The issue allows remote attackers to read arbitrary files by uploading a ZIP file containing a shortcut (.LNK) file, using the SITE UNZIP command to extract the .LNK file onto the server, and then accessing the file.

Recommendations For versions prior to 1.4.2.7, update to version 1.4.2.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SITE UNZIP command to minimize the risk of exploitation. Avoid using the SITE UNZIP command with ZIP files containing .LNK files until the issue is resolved.

Fix

Related Identifiers

CVE-2005-0519

Affected Products

Argosoft Ftp Server

References · 6

• http://secunia.com/advisories/14172 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-0519 · Security Note
• http://argosoft.com/ftpserver/changelist.aspx · Vendor Advisory
• http://securityfocus.com/bid/12487 · Note
• http://osvdb.org/13614 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17939 · Note