PT-2005-3062 · Microsoft · Windows Server 2003+3

Published 2005-10-21 · Updated 2018-10-12 · CVE-2005-2126

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Windows XP version SP1 Windows Server 2003 (affected versions not specified) Internet Explorer 6 version SP1 on Windows 2000 version SP4

Description: The issue allows remote FTP servers to overwrite files in arbitrary locations via crafted filenames when the "Enable Folder View for FTP Sites" option is enabled and a user manually initiates a file transfer.

Recommendations: For Windows XP SP1, update the FTP client to prevent remote FTP servers from overwriting files. For Windows Server 2003, apply the necessary configuration changes to restrict file transfer capabilities. For Internet Explorer 6 SP1 on Windows 2000 SP4, disable the "Enable Folder View for FTP Sites" option to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-2126

Affected Products

Internet Explorer 6

Windows 2000

Windows Server 2003

Windows Xp

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-044 · Vendor Advisory
• http://secunia.com/advisories/17163 · Vendor Advisory
• http://securiteam.com/windowsntfocus/6M00I0KEAU.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-2126 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1146 · Note
• http://securitytracker.com/id?1015036 · Note
• http://secunia.com/advisories/17223 · Note
• http://support.avaya.com/elmodocs2/security/ASA-2005-214.pdf · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1284 · Note
• http://secunia.com/advisories/17172 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1416 · Note
• http://kb.cert.org/vuls/id/415828 · Note