(PVS) Signatures - Tenable Network Security

CVE Not available
Platinum FTP server Multiple Vulnerabilities
PVS ID: 1825 FAMILY: FTP Servers RISK: HIGH NESSUS ID:11200
Description: Synopsis :\n\nThe remote host is vulnerable to multiple attack vectors.\n\nPlatinum FTP
server for Win32 has several vulnerabilities in the way it checks the format of command
strings passed to it. This leads to the following vulnerabilities in the server: The 'dir'
command can be used to examine the filesystem of the machine and gather further
information about the host by using relative directory listings (I.E. '../../../' or '\..\..\..'). The
'delete' command can be used to delete any file on the server that the Platinum FTP server
has permissions to. Issuing the command 'cd @/..@/..' will cause the Platinum FTP server
to crash and consume all available CPU time on the server.
Solution: Upgrade or patch according to vendor recommendations.
CVE Not available
NiteServer < 1.85 FTP Server Traversal Directory Listing
PVS ID: 1826 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:11466
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw which allows attackers to retrieve
sensitive files or data.\n\nThe remote FTP server allows anybody to switch to the root
directory and read potentially sensitive files.
Solution: Upgrade to version 1.85 or higher.
CVE-2003-1349
AIX FTPd libc Library Remote Overflow
PVS ID: 1827 FAMILY: FTP Servers RISK: HIGH NESSUS ID:10009
Description: Synopsis :\n\nThe remote host is vulnerable to a buffer overflow.\n\nIt is possible to make
the remote FTP server crash by issuing this command : CEL aaaa[...]aaaa. This problem is
known as the 'AIX FTPd' overflow and may allow the remote user to easily gain access to
the root (super-user) account on the remote system.
Solution: See IBM's advisory number ERS-SVA-E01-1999:004.1 or contact your vendor for a patch.
CVE-1999-0789
bftpd < 1.0.14 chown Command Overflow
Passive Vulnerability Scanner (PVS) Signatures
PVS ID: 1828 FAMILY: FTP Servers RISK: HIGH NESSUS ID:10579
Family Internet Services 464