CVE-2008-5124 JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks.
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jscape secure ftp applet | <= 4.8.0 | No fix listed |
| jscape secure ftp applet | = 1.1 | No fix listed |
| jscape secure ftp applet | = 1.2 | No fix listed |
| jscape secure ftp applet | = 1.3 | No fix listed |
| jscape secure ftp applet | = 1.4 | No fix listed |
| jscape secure ftp applet | = 1.5 | No fix listed |
| jscape secure ftp applet | = 1.6 | No fix listed |
| jscape secure ftp applet | = 2.0 | No fix listed |
| jscape secure ftp applet | = 2.1 | No fix listed |
| jscape secure ftp applet | = 2.5 | No fix listed |
| jscape secure ftp applet | = 2.6 | No fix listed |
| jscape secure ftp applet | = 3.0 | No fix listed |
| jscape secure ftp applet | = 3.0.1 | No fix listed |
| jscape secure ftp applet | = 3.0.2 | No fix listed |
| jscape secure ftp applet | = 3.0.3 | No fix listed |
| jscape secure ftp applet | = 3.0.4 | No fix listed |
| jscape secure ftp applet | = 4.0 | No fix listed |
| jscape secure ftp applet | = 4.2.0 | No fix listed |
| jscape secure ftp applet | = 4.3.0 | No fix listed |
| jscape secure ftp applet | = 4.4.0 | No fix listed |
| jscape secure ftp applet | = 4.5.0 | No fix listed |
| jscape secure ftp applet | = 4.6.0 | No fix listed |
| jscape secure ftp applet | = 4.7 | No fix listed |
References
- 30822 third-party-advisory vendor-advisory
- 4606 third-party-advisory
- www.jscape.com
- 20080623 n.runs-SA-2008.001 - Jscape Secure FTP Applet mailing-list
- 20080625 ERRATA - n.runs-SA-2008.001 - Jscape Secure FTP Applet mailing-list
- 29882 vdb-entry
- 1020346 vdb-entry
- ADV-2008-1919 vdb-entry
- jscape-certificate-spoofing(43300) vdb-entry