GuildFTPD Plaintext Password Storage Vulnerability

Bugtraq ID:	2792
Class:	Design Error
CVE:	CVE-2001-0768
Remote:	Yes
Local:	No
Published:	May 26 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	Discovered and posted to Bugtraq by ByteRage <[email protected]> on May 26, 2001.
Vulnerable:	DrPhibez and Nitro187 Guild FTPD 0.9.7 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0
Not Vulnerable:

GuildFTPD Plaintext Password Storage Vulnerability

GuildFTPD is a free Windows-based ftp server by DrPhibez and Nitro187.

GuildFTPD's user credentials are stored in plain text in a document residing in the program's directory. Users may gain access to the file through the use of a trivial directory traversal bug (BID #2789).

GuildFTPD Plaintext Password Storage Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GuildFTPD Plaintext Password Storage Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GuildFTPD Plaintext Password Storage Vulnerability

References:

• Guild FTPD Homepage (Dr.Phibez and Nitro187)
  
• GuildFTPD Directory Traversal Vulnerability (SecurityFocus)