FileZilla FTP Client Hard-Coded Cipher Key Vulnerability

Bugtraq ID:	14730
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 02 2005 12:00AM
Updated:	Sep 02 2005 12:00AM
Credit:	Discovery is credited to <[email protected]>.
Vulnerable:	FileZilla FileZilla 2.2.15
Not Vulnerable:

FileZilla FTP Client Hard-Coded Cipher Key Vulnerability

FileZilla FTP client may allow local attackers to obtain user passwords and access remote servers.

The application uses a hard-coded cipher key to decrypt the password, which is stored in an XML file or the Windows Registry.

This can allow the attacker to gain access to an FTP server with the privileges of the victim.

FileZilla FTP Client Hard-Coded Cipher Key Vulnerability

An exploit is not required.

The following proof of concept is available:

• /data/vulnerabilities/exploits/FileZilla_pass.c

FileZilla FTP Client Hard-Coded Cipher Key Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FileZilla FTP Client Hard-Coded Cipher Key Vulnerability

References:

• FileZilla Homepage (FileZilla )
  
• FileZilla weakly-encrypted password vulnerability (m123303[ - at - ]richmond.ac.uk)