BID:27602

Xlight FTP Server LDAP Blank Password Authentication Bypass Vulnerability

Info

Xlight FTP Server LDAP Blank Password Authentication Bypass Vulnerability

Bugtraq ID:	27602
Class:	Access Validation Error
CVE:	CVE-2008-0604
Remote:	Yes
Local:	No
Published:	Feb 04 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	The vendor reported this issue.
Vulnerable:	XLight FTP Server XLight FTP Server 2.8 XLight FTP Server XLight FTP Server 2.7 XLight FTP Server XLight FTP Server 2.6 XLight FTP Server XLight FTP Server 2.5 XLight FTP Server XLight FTP Server 2.4 XLight FTP Server XLight FTP Server 2.3 XLight FTP Server XLight FTP Server 2.2 XLight FTP Server XLight FTP Server 2.1 XLight FTP Server XLight FTP Server 2.01 XLight FTP Server XLight FTP Server 2.0

Not Vulnerable:	XLight FTP Server XLight FTP Server 2.83

Discussion

Xlight FTP Server LDAP Blank Password Authentication Bypass Vulnerability

Xlight FTP Server is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to gain unauthorized access to the affected application.

This issue affects versions prior to Xlight FTP Server 2.83.

Exploit / POC

Xlight FTP Server LDAP Blank Password Authentication Bypass Vulnerability

No specific exploit code is required. An attacker must have prior knowledge of a valid username and must access an FTP client.

Solution / Fix

Xlight FTP Server LDAP Blank Password Authentication Bypass Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

XLight FTP Server XLight FTP Server 2.0