PT-2014-4892 · Martin Prikryl · Winscp

Published 2014-04-21 · Updated 2018-10-09 · CVE-2014-2735

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WinSCP versions prior to 5.5.3

Description The issue arises when using FTP with TLS, as it fails to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This allows attackers to potentially spoof SSL servers via an arbitrary valid certificate.

Recommendations For versions prior to 5.5.3, update to version 5.5.3 or later to resolve the issue. As a temporary workaround, consider disabling the use of FTP with TLS until the update is applied. Restrict access to sensitive data and servers to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-2735

Affected Products

Winscp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-2735 · Security Note
• http://winscp.net/tracker/show_bug.cgi?id=1152 · Note
• http://winscp.net/eng/docs/history · Note
• http://securityfocus.com/archive/1/531847/100/0/threaded · Note