[NT] FtpXQ Default Install Read/Write Capabilities
From: support@securiteam.comDate: 12/19/01
- Previous message: support@securiteam.com: "[NT] Analysis of Microsoft SQL Server 2000 Stored Procedure Encryption"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: Wed, 19 Dec 2001 13:29:37 +0100 (CET)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
FtpXQ Default Install Read/Write Capabilities
------------------------------------------------------------------------
SUMMARY
When installing
<http://www.datawizard.net/Free_Software/FtpXQ_Free/ftpxq_free.htm> FtpXQ
with default settings, it is possible through anonymous and/or through the
username and password of 'test' for a remote attacker to gain read/write
access to whole drive c: of the computer upon the product was installed.
DETAILS
Vendor response:
… Yes, those IDs are configured by default to have access for the C:\
drive for the purpose of an administrator testing the server. We assume
that every responsible administrator will run the server first in a test
environment, and not in a production setting, or on an IP that is exposed
to the internet. Administrators should obviously change the access for
both of these accounts and/or change the User IDs before putting it into a
production environment. Because of your email however, we will change the
default access for the anonymous user to be read only, as well as post a
message at the end of the install noting the default access for the test
users…
Workaround:
Make sure you delete the account 'test', modify its password, or restrict
its access. Disable anonymous access.
ADDITIONAL INFORMATION
The information has been provided by <mailto:tuck167@hotmail.com> Brice
Carlson.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: support@securiteam.com: "[NT] Analysis of Microsoft SQL Server 2000 Stored Procedure Encryption"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
