Network-Client FTP Now Local Password Disclosure Vulnerability

Bugtraq ID:	13052
Class:	Design Error
CVE:	CVE-2005-1094
Remote:	No
Local:	Yes
Published:	Apr 07 2005 12:00AM
Updated:	Jul 12 2009 12:56PM
Credit:	Discovery is credited to Kozan <[email protected]>.
Vulnerable:	Network-Client FTP Now 2.6.14
Not Vulnerable:

Network-Client FTP Now Local Password Disclosure Vulnerability

FTP Now is reported prone to a vulnerability that can allow an attacker to disclose FTP passwords.

A local attacker can gain access to a file, which contains the credentials in plain text format.

The attacker may then use these credentials to access remote FTP servers and carry out other attacks.

FTP Now 2.6.14 is reported prone, however, it is possible that other versions are affected as well.

Network-Client FTP Now Local Password Disclosure Vulnerability

An exploit is not required.

Network-Client FTP Now Local Password Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Network-Client FTP Now Local Password Disclosure Vulnerability

References:

• FTP Now Product Page (Network-Client)