PT-2005-5338 · Ioftpd · Ioftpd

Published 2005-12-31 · Updated 2008-09-05 · CVE-2005-4673

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ioFTPD version 0.5.84 u

Description The issue allows remote attackers to enumerate valid usernames by analyzing different response messages from the software, depending on whether a username exists or not.

Recommendations For ioFTPD version 0.5.84 u, consider modifying the response mechanism to prevent differentiation in messages based on username existence, thereby mitigating the risk of username enumeration.

Fix

Related Identifiers

CVE-2005-4673

Affected Products

Ioftpd

References · 5

• http://critical.lt/?vulnerabilities/119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4673 · Security Note
• http://security.nnov.ru/Kdocument79.html · Vendor Advisory
• http://osvdb.org/22709 · Note
• http://securityfocus.com/bid/15253 · Note