Wing FTP Server LDAP Authentication Bypass
medium Nessus Plugin ID 54956
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote FTP service is vulnerable to an authentication bypass attack.Description
The remote FTP server is running a version of Wing FTP Server earlier than 3.8.7. As such, it reportedly is affected by an authentication bypass vulnerability when LDAP or Active Directory authentication is used.An attacker can exploit this issue by logging into the FTP server with an empty password. Successfully exploiting this issue requires that the LDAP server allows anonymous binds as well as knowledge of a valid account.
Solution
Upgrade to version 3.8.7 or later.See Also
Plugin Details
Severity: Medium
ID: 54956
File Name: wing_ftp_server_387.nasl
Version: 1.9
Type: local
Family: FTP
Published: 6/3/2011
Updated: 11/15/2018
Dependencies: wing_ftp_server_detect.nasl
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3.3
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N
Temporal Vector: E:F/RL:OF/RC:C
Vulnerability Information
CPE: cpe:/a:wftpserver:wing_ftp_server
Required KB Items: SMB/Wing_FTP/Version
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/26/2011
Vulnerability Publication Date: 5/26/2011
Reference Information
BID: 47998
Secunia: 44718