DataWizard FtpXQ Server Multiple Remote Vulnerabilities
BID:20721
Info
DataWizard FtpXQ Server Multiple Remote Vulnerabilities
| Bugtraq ID: | 20721 |
| Class: | Design Error |
| CVE: |
CVE-2006-5568 CVE-2006-5569 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 24 2006 12:00AM |
| Updated: | Nov 17 2009 09:06PM |
| Credit: | Greg Linares <[email protected]> is credited with the discovery of these issues. |
| Vulnerable: |
DataWizard FtpXQ 3.01 |
| Not Vulnerable: | |
Discussion
DataWizard FtpXQ Server Multiple Remote Vulnerabilities
DataWizard FtpXQ Server is prone to multiple remote vulnerabilities:
- A remote denial-of-service issue occurs because the application fails to perform adequate bounds checks on user-supplied data before copying it to an insufficiently sized buffer. An attacker could exploit this issue to crash the application, denying access to legitimate users.
- The application creates two testing accounts by default. An attacker can access these accounts to gain read/write privileges on the server, which could result in the compromise of the affected computer.
FtpXQ Server 3.01 is vulnerable; other version may also be affected.
DataWizard FtpXQ Server is prone to multiple remote vulnerabilities:
- A remote denial-of-service issue occurs because the application fails to perform adequate bounds checks on user-supplied data before copying it to an insufficiently sized buffer. An attacker could exploit this issue to crash the application, denying access to legitimate users.
- The application creates two testing accounts by default. An attacker can access these accounts to gain read/write privileges on the server, which could result in the compromise of the affected computer.
FtpXQ Server 3.01 is vulnerable; other version may also be affected.
Exploit / POC
DataWizard FtpXQ Server Multiple Remote Vulnerabilities
The following exploits are available for the denial-of-service vulnerability:
The following exploits are available for the denial-of-service vulnerability:
Solution / Fix
DataWizard FtpXQ Server Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
DataWizard FtpXQ Server Multiple Remote Vulnerabilities
References:
References:
- DataWizard Homepage (DataWizard)