ArGoSoft FTP Server Remote User Enumeration Vulnerability

Bugtraq ID:	12139
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 31 2004 12:00AM
Updated:	Dec 31 2004 12:00AM
Credit:	[email protected] is credited with the discovery of this issue.
Vulnerable:	ArGo Software Design FTP Server 1.4.2 .0 ArGo Software Design FTP Server 1.4.1 .9 ArGo Software Design FTP Server 1.4.1 .8 ArGo Software Design FTP Server 1.4.1 .7 ArGo Software Design FTP Server 1.4.1 .6 ArGo Software Design FTP Server 1.4.1 .5 ArGo Software Design FTP Server 1.4.1 .4 ArGo Software Design FTP Server 1.4.1 .3 ArGo Software Design FTP Server 1.4.1 .2 ArGo Software Design FTP Server 1.4.1 .1
Not Vulnerable:	ArGo Software Design FTP Server 1.4.2 .2 ArGo Software Design FTP Server 1.4.2 .1

ArGoSoft FTP Server Remote User Enumeration Vulnerability

A remote information disclosure vulnerability reportedly ArGoSoft FTP Server. This issue is due to a design error that can be leveraged to present sensitive information to attacks.

An attacker may leverage this issue to harvest valid usernames, potentially facilitating brute force attacks.

ArGoSoft FTP Server Remote User Enumeration Vulnerability

No exploit is required to leverage this issue.

ArGoSoft FTP Server Remote User Enumeration Vulnerability

Solution:
The vendor has provided an upgrade dealing with this issue. Users of the affected software are advised to contact the vendor for more information on gaining accessed to the updated version.

ArGoSoft FTP Server Remote User Enumeration Vulnerability

References:

• ArGoSoft FTP Server Product Home Page (ArGoSoft)
  
• ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks ([email protected])