CVE-2004-1948 NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information via "ps aux," which dis...
MediumCVSS 4.6
EPSS 0.46%
- Published
- Updated
- Exploit status
- No public exploit known
Description
NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information via "ps aux," which displays the URL in the process list.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ncftp software ncftp | = 3.0.0 | No fix listed |
| ncftp software ncftp | = 3.0.1 | No fix listed |
| ncftp software ncftp | = 3.0.2 | No fix listed |
| ncftp software ncftp | = 3.0.3 | No fix listed |
| ncftp software ncftp | = 3.0.4 | No fix listed |
| ncftp software ncftp | = 3.1.0 | No fix listed |
| ncftp software ncftp | = 3.1.1 | No fix listed |
| ncftp software ncftp | = 3.1.2 | No fix listed |
| ncftp software ncftp | = 3.1.3 | No fix listed |
| ncftp software ncftp | = 3.1.4 | No fix listed |
| ncftp software ncftp | = 3.1.5 | No fix listed |
| ncftp software ncftp | = 3.1.6 | No fix listed |
| ncftp software ncftp | = 3.1.7 | No fix listed |
| debian/ncftp(Debian:12) | < 2:3.1.8-1 | 2:3.1.8-1 |
| debian/ncftp(Debian:13) | < 2:3.1.8-1 | 2:3.1.8-1 |
| debian/ncftp(Debian:14) | < 2:3.1.8-1 | 2:3.1.8-1 |
References
- 20040419 NcFTP - password leaking mailing-list
- 11438 exploit third-party-advisory vendor-advisory
- 5595 vdb-entry
- 10182 vdb-entry vendor-advisory
- ncftp-info-disclosure(15919) vdb-entry
- Debian Security Tracker CVE-2004-1948 vendor-advisory