PT-2007-2120 · Ipswitch · Ipswitch Ws Ftp Server

Published 2007-02-02 · Updated 2018-10-16 · CVE-2007-0666

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ipswitch WS FTP Server version 5.04

Description The issue allows FTP site administrators to execute arbitrary code on the system. This can be achieved by providing a long input string to certain files or modules, specifically the (1) iFTPAddU or (2) iFTPAddH file, or to a (3) edition module.

Recommendations For Ipswitch WS FTP Server version 5.04, consider restricting access to the iFTPAddU and iFTPAddH files, as well as the edition module, to minimize the risk of exploitation. As a temporary workaround, limit the input string length to prevent arbitrary code execution until a patch is available.

Fix

Related Identifiers

CVE-2007-0666

Affected Products

Ipswitch Ws Ftp Server

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-0666 · Security Note
• http://securityfocus.com/archive/1/458942/100/0/threaded · Note
• http://securityfocus.com/archive/1/459023/100/0/threaded · Note
• http://osvdb.org/33647 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32176 · Note
• http://securityfocus.com/archive/1/458774/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0666 · Note
• http://securityfocus.com/archive/1/458932/100/0/threaded · Note
• http://osvdb.org/33646 · Note