Win FTP Server Plaintext Password Storage Weakness

Bugtraq ID:	11749
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 24 2004 12:00AM
Updated:	Nov 24 2004 12:00AM
Credit:	GSS IT <[email protected]> disclosed this weakness.
Vulnerable:	Win FTP Server Win FTP Server 1.6
Not Vulnerable:

Win FTP Server Plaintext Password Storage Weakness

It is reported that Win FTP Server stores user account information in a plaintext file on the server filesystem.

As a result, FTP user credentials could be exposed to other local users who have permissions to access this file. Malicious users that gain access to FTP user credentials may be able to gain access to potentially sensitive files served by the application.

Version 1.6 of the application is reportedly affected by this weakness. Other versions are also likely affected.

Win FTP Server Plaintext Password Storage Weakness

An exploit is not required.

Win FTP Server Plaintext Password Storage Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Win FTP Server Plaintext Password Storage Weakness

References:

• Win FTP Server Home Page (Win FTP Server)