PT-2023-29452 · Netbsd · Ftpd

Published 2023-10-05 · Updated 2023-10-11 · CVE-2023-45198

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ftpd versions prior to 20230930 tnftpd versions prior to 20231001

Description The issue allows information about the host filesystem to be leaked before authentication via an MLSD or MLST command.

Recommendations For ftpd versions prior to 20230930, update to NetBSD-ftpd 20230930 or later. For tnftpd versions prior to 20231001, update to version 20231001 or later. As a temporary workaround, consider restricting access to the MLSD and MLST commands until a patch is available.

Fix

Related Identifiers

CVE-2023-45198

Affected Products

Ftpd

References · 7

• https://mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45198 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45198 · Vendor Advisory
• http://cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95 · Patch
• https://twitter.com/VulmonFeeds/status/1709882904870826405 · Twitter Post
• https://t.me/latest_high_impact_cve/18 · Telegram Post
• https://t.me/cvenotify/59033 · Telegram Post