PT-2017-13959 · Microsoft · Psftpd

Published 2017-11-15 · Updated 2019-10-03 · CVE-2017-15272

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PSFTPd version 10.0.4 Build 729

Description The issue concerns the storage of configuration data in a Microsoft Access Database file named PSFTPd.dat. This file can be extracted without requiring the password set by the application, which is "ITsILLEGAL". Furthermore, user passwords are stored in cleartext.

Recommendations For PSFTPd version 10.0.4 Build 729, consider changing the way configuration data is stored and securing user passwords to prevent unauthorized access. As a temporary workaround, restrict access to the PSFTPd.dat file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Improper Authentication

Weakness Enumeration

CWE-522

CWE-287

Related Identifiers

CVE-2017-15272

Affected Products

Psftpd

References · 5

• https://osv.dev/vulnerability/CVE-2017-15272 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15272 · Security Note
• http://securityfocus.com/archive/1/541518/100/0/threaded · Note
• https://x41-dsec.de/lab/advisories/x41-2017-006-psftpd · Note
• http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html · Note