Serv-U < 2.5e CWD Command Path Disclosure

Medium Nessus Network Monitor Plugin ID 1837

Synopsis

The remote host may give an attacker information useful for future attacks.

Description

The remote FTP server discloses the full path to its root through a CWD command done to a non-existant directory.

Solution

Upgrade to Serv-U 2.5e or higher.

See Also

http://archives.neohapsis.com/archives/bugtraq/1999-q4/0176.html

http://archives.neohapsis.com/archives/bugtraq/2000-02/0417.html

Plugin Details

Severity: Medium

ID: 1837

Family: FTP Servers

Published: 2004/08/20

Modified: 2016/01/21

Dependencies: 1853

Nessus ID: 11392

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 4.9

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Reference Information

CVE: CVE-2000-0176, CVE-1999-0838

BID: 1016, 859