RhinoSoft Serv-U FTP Server Default Administration Account Vulnerability

Bugtraq ID:	10886
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 08 2004 12:00AM
Updated:	Aug 08 2004 12:00AM
Credit:	Discovery is credited to aT4r ins4n3 <[email protected]>.
Vulnerable:	Rhino Software Serv-U 6.0 .0.1 Rhino Software Serv-U 6.0 Rhino Software Serv-U 5.2 .0.0 Rhino Software Serv-U 5.1 .0 Rhino Software Serv-U 5.0 .0.9 Rhino Software Serv-U 5.0 .0.6 Rhino Software Serv-U 5.0 .0.4 Rhino Software Serv-U 4.2 Rhino Software Serv-U 4.1 .0.11 Rhino Software Serv-U 4.1 Rhino Software Serv-U 4.0 .0.4 Rhino Software Serv-U 3.1 Rhino Software Serv-U 3.0
Not Vulnerable:

RhinoSoft Serv-U FTP Server Default Administration Account Vulnerability

It is reported that the RhinoSoft Serv-U FTP server has a default administration account that is used to authenticate to the site maintenance interface.

The weak account can be used to log into the site maintenance interface on the loopback interface only, and to create user accounts. An ftp user account created with execute rights, may permit a local attacker to execute arbitrary binaries in the context of the vulnerable server.

RhinoSoft Serv-U FTP Server Default Administration Account Vulnerability

CORE has developed a working commercial exploit for their IMPACT
product. This exploit is not otherwise publicly available or known
to be circulating in the wild.

The following exploit is available:

• /data/vulnerabilities/exploits/servulocal.c

RhinoSoft Serv-U FTP Server Default Administration Account Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

RhinoSoft Serv-U FTP Server Default Administration Account Vulnerability

References:

• Serv-U Homepage (RhinoSoft)
  
• Serv-U LocalAdministrator exploit (CORE Security)