freeFTPd.exe in freeFTPd through 1.0.11 allows remote attackers to bypass authentication via a crafted SFTP session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.

The SFTP server included with freeFTPd or freeSSHd has an authentication bypass vulnerability.  Authentication can be bypassed by opening an SSH channel before any credentials are provided.  A remote, unauthenticated attacker could exploit this to login without providing credentials. 

After logging in, uploading specially crafted files could result in arbitrary code execution as SYSTEM.  Refer to the researcher's advisory for more information.

Detections

Analytics

CVE-2012-6067

critical

Tenable Plugins

high