FTP : Solaris FTPd tells if a user exists

Anfälligkeitssuche		Suche in 324607 CVE Beschreibungen und 145615 Test Beschreibungen, Zugriff auf 10,000+ Quellverweise.
	Tests CVE Alle

Test Kennung: 1.3.6.1.4.1.25623.1.0.10653

Kategorie: FTP

Titel: Solaris FTPd tells if a user exists

Zusammenfassung: NOSUMMARY

Beschreibung: Description:

It is possible to determine the existence of a
user on the remote system by issuing the command
CWD ~
, even before logging in.

Ie:
telnet target 21
CWD ~
root
530 Please login with USER and PASS.

CWD ~
nonexistinguser
530 Please login with USER and PASS.
550 Unknown user name after ~

An attacker may use this to determine the existence of
known to be vulnerable accounts (like guest) or to
determine which system you are running.

Solution : inform your vendor, and ask for a patch, or
change your FTP server

Risk factor : Low

Querverweis: BugTraq ID: 2564

Copyright This script is Copyright (C) 2001 Renaud Deraison

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.
Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.

Test Kennung:	1.3.6.1.4.1.25623.1.0.10653
Kategorie:	FTP
Titel:	Solaris FTPd tells if a user exists
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: It is possible to determine the existence of a user on the remote system by issuing the command CWD ~ , even before logging in. Ie: telnet target 21 CWD ~ root 530 Please login with USER and PASS. CWD ~ nonexistinguser 530 Please login with USER and PASS. 550 Unknown user name after ~ An attacker may use this to determine the existence of known to be vulnerable accounts (like guest) or to determine which system you are running. Solution : inform your vendor, and ask for a patch, or change your FTP server Risk factor : Low
Querverweis:	BugTraq ID: 2564
Copyright	This script is Copyright (C) 2001 Renaud Deraison