PT-2007-1229 · Conti · Conti Ftpserver

Published 2007-01-23 · Updated 2017-07-29 · CVE-2006-6949

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Conti FTPServer version 1.0 Build 2.8

Description: The issue allows local users to obtain sensitive information by reading the MyServerSettings.ini file, which stores user passwords in cleartext.

Recommendations: For Conti FTPServer version 1.0 Build 2.8, consider encrypting or hashing user passwords to prevent them from being stored in cleartext, and restrict access to the MyServerSettings.ini file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-6949

Affected Products

Conti Ftpserver

References · 6

• http://secunia.com/advisories/23030 · Vendor Advisory
• http://securityfocus.com/bid/21174 · Vendor Advisory
• http://secwatch.org/advisories/1016194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6949 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30412 · Note
• http://vupen.com/english/advisories/2006/4605 · Note