(PVS) Signatures - Tenable Network Security

CVE-2001-0247
FTP Server 'glob' Function Overflow
PVS ID: 1836 FAMILY: FTP Servers RISK: HIGH NESSUS ID:10648
Description: Synopsis :\n\nThe remote host is vulnerable to a globbing overflow.\n\nIt may be possible
to make the remote FTP server crash by creating a large directory structure and then
attempting to list it using wildcards. This is usually known as the 'ftp glob overflow' attack.
An attacker can use this flaw to execute arbitrary code on the remote server, which could
lead to remote shell access.
Solution: Upgrade your FTP server and/or libc. Consider removing directories writable by
'anonymous'.
CVE-2001-0247
Serv-U < 2.5e CWD Command Path Disclosure
PVS ID: 1837 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:11392
Description: Synopsis :\n\nThe remote host may give an attacker information useful for future
attacks.\n\nThe remote FTP server discloses the full path to its root through a CWD
command done to a non-existant directory.
Solution: Upgrade to Serv-U 2.5e or higher.
CVE-1999-0838
Serv-U < 2.5i CD Command Traversal Directory / File Access
PVS ID: 1838 FAMILY: FTP Servers
RISK:
MEDIUM
NESSUS ID:10565
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw which allows attackers to retrieve
sensitive files or data.\n\nIt is possible to break out of the remote FTP chroot by appending
%20s in the CWD command, as in : CWD %20.. This problem allows an attacker to browse
the entire remote file system.
Solution: Upgrade to Serv-U 2.5i or higher.
CVE-2001-0054
Passive Vulnerability Scanner (PVS) Signatures
GuildFTPd Directory Traversal Arbitrary File Access
PVS ID: 1839 FAMILY: FTP Servers RISK: LOW NESSUS ID:Not Available
Description: Synopsis :\n\nThe remote host is vulnerable to a flaw which allows attackers to retrieve
sensitive files or data.\n\nVersion 0.97 of GuildFTPd was detected. A security vulnerability
in this product allows anyone with a valid FTP login to read arbitrary files on the system.
Family Internet Services 467