Pablo Software Solutions FTP Service Anonymous Users Privileges Vulnerability
BID:7799
Info
Pablo Software Solutions FTP Service Anonymous Users Privileges Vulnerability
| Bugtraq ID: | 7799 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 03 2003 12:00AM |
| Updated: | Jun 03 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to JeiAr <[email protected]>. |
| Vulnerable: |
Pablo Software Solutions FTP Service 1.2 |
| Not Vulnerable: | |
Discussion
Pablo Software Solutions FTP Service Anonymous Users Privileges Vulnerability
An issue in Pablo FTP Service may make it possible for remote users to perform unauthorized actions.
It has been reported that Pablo FTP Service does not sufficiently restrict the anonymous user account, which is active by default. Because of this, a default configuration may provide a conduit for the disclosure of potentially sensitive information.
An attacker may exploit this vulnerability to access arbitrary files on the underlying system and potentially disclose sensitive information.
It should be noted that while this vulnerability has been reported to affect Pablo FTP service version 1.2, other versions might also be affected.
An issue in Pablo FTP Service may make it possible for remote users to perform unauthorized actions.
It has been reported that Pablo FTP Service does not sufficiently restrict the anonymous user account, which is active by default. Because of this, a default configuration may provide a conduit for the disclosure of potentially sensitive information.
An attacker may exploit this vulnerability to access arbitrary files on the underlying system and potentially disclose sensitive information.
It should be noted that while this vulnerability has been reported to affect Pablo FTP service version 1.2, other versions might also be affected.
Exploit / POC
Pablo Software Solutions FTP Service Anonymous Users Privileges Vulnerability
The following proof of concept has been provided:
ftp://www.example.com/windows/repair/sam
The following proof of concept has been provided:
ftp://www.example.com/windows/repair/sam
Solution / Fix
Pablo Software Solutions FTP Service Anonymous Users Privileges Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Pablo Software Solutions FTP Service Anonymous Users Privileges Vulnerability
References:
References:
- FTP Service Homepage (Pablo Software Solutions)
- Vulnerabilities In Pablo Software Solutions FTP Service 1.2 (JeiAr