PT-2008-2229 · Xlight · Xlight Ftp Server

Published 2008-02-06 · Updated 2008-09-05 · CVE-2008-0604

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XLight FTP Server versions prior to 2.83

Description The issue concerns the LDAP authentication feature, which fails to check for blank passwords when used with certain LDAP servers. This allows remote attackers to bypass intended access restrictions.

Recommendations For versions prior to 2.83, update to version 2.83 or later to resolve the issue. As a temporary workaround, consider disabling the LDAP authentication feature until the update is applied. Restrict access to the LDAP authentication module to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-0604

Affected Products

Xlight Ftp Server

References · 4

• http://secunia.com/advisories/28755 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-0604 · Security Note
• http://securityfocus.com/bid/27602 · Patch
• http://xlightftpd.com/whatsnew.htm · Note