Synopsis :

The remote host is running a Gopher server that is configured as a
proxy.

Description :

The remote host is running a UMN Gopher server.

It is possible to make the remote server connect to third
party FTP sites by sending the request
'ftp://hostname.of.the.ftp.server'.

An attacker may exploit this flaw to connect to use the remote
gopher daemon as a proxy to connect to FTP servers without disclosing
their IP address.

An attacker could also exploit this flaw to 'ping' the hosts
of your network.

Solution :

Disable FTP support in the remote gopher server

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 5.0
(CVSS2#E:H/RL:U/RC:ND)
Public Exploit Available : true