PT-2005-4801 · Ghisler · Total Commander

Published 2005-12-07 · Updated 2017-07-20 · CVE-2005-4066

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Total Commander version 6.53

Description The issue concerns the use of weak encryption in storing FTP usernames and passwords in the WCX FTP.INI file, allowing local users to decrypt the passwords and gain unauthorized access to FTP servers.

Recommendations For version 6.53, consider updating the storage mechanism for FTP credentials to use stronger encryption methods to protect against unauthorized access. As a temporary workaround, restrict access to the WCX FTP.INI file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2005-4066

Affected Products

Total Commander

References · 5

• http://networksecurity.fi/advisories/total-commander.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4066 · Security Note
• http://vupen.com/english/advisories/2005/2780 · Vendor Advisory
• http://securitytracker.com/id?1015311 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23497 · Note