FTP: Vulnerable Serv-U FTP version (< 2.6)
This signature detects RhinoSoft Serv-U FTP version 2.5 and earlier. These versions have a vulnerability in the CWD command that allow users to access any file on the remote server.
Extended Description
The default settings for Serv-U cause the server to give out full physical path information in the following circumstances. A user attempting to retreive a non-existant file or change to a non-existant directory will see: 550 /d:/ftproot/nonexist: No such file or directory. A user changing to an existing directory will see: 250 Directory changed to /d:/ftproot/exist This information could be used to simplify other attacks.
Affected Products
Cat_soft serv-u
Short Name
FTP:VULN:SERV-U-FTP-2-6
Severity
Info
Recommended
False
Recommended Action
None
Category
FTP
Keywords
(< 2.6) CVE-2000-0176 FTP Serv-U Vulnerable bid:1016 version
Release Date
02/02/2005
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3375
False Positive
Rarely
Vendors
Cat_soft
CVSS Score
5.0