CVE-2005-1646 The default installation of Fastream NETFile FTP/Web Server 7.4.6, which supports FXP, does not require that the IP address in a PORT command be the same as the IP of the logged in user, which allows....
HighCVSS 7.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default installation of Fastream NETFile FTP/Web Server 7.4.6, which supports FXP, does not require that the IP address in a PORT command be the same as the IP of the logged in user, which allows remote attackers to conduct FTP Bounce attacks to bypass firewall rules or cause a denial of service.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fastream netfile ftp web server | = 7.4.6 | No fix listed |
References
- 15394 third-party-advisory vendor-advisory
- 16621 vdb-entry
- www.security.org.sg exploit patch
- ADV-2005-0556 vdb-entry