FTP Privileged Port Bounce Scan

High Nessus Plugin ID 10081

Synopsis

The remote FTP server is vulnerable to a FTP server bounce attack.

Description

It is possible to force the remote FTP server to connect to third parties using the PORT command.

The problem allows intruders to use your network resources to scan other hosts, making them think the attack comes from your network.

Solution

See the CERT advisory in the references for solutions and workarounds.

See Also

https://seclists.org/bugtraq/1995/Jul/46

Plugin Details

Severity: High

ID: 10081

File Name: ftp_bounce.nasl

Version: 1.49

Type: remote

Family: FTP

Published: 1999/06/22

Updated: 2018/11/15

Dependencies: 18367, 10092, 10079

Risk Information

Risk Factor: High

CVSS Score Source: CVE-1999-0017

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Vulnerability Information

Required KB Items: ftp/login

Excluded KB Items: ftp/ncftpd

Exploit Available: false

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1995/07/12

Reference Information

CVE: CVE-1999-0017

BID: 126

CERT-CC: CA-1997-27