Authentication flaw

2023-10-0505:15:00

PRIOn knowledge base

www.prio-n.com

authentication

flaw

netbsd-ftpd

tnftpd

information leakage

mlsd command

mlst command

nvd

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.2%

JSON

ftpd before “NetBSD-ftpd 20230930” can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable.

CPENameOperatorVersion
ftpdeq< 2023930
tnftpdeq< 2023101

CPE	Name	Operator	Version
	ftpd	eq	< 2023930
	tnftpd	eq	< 2023101

References

cvsweb.netbsd.org/bsdweb.cgi/src/libexec/ftpd/ftpcmd.y.diff?r1=1.94&r2=1.95

mail-index.netbsd.org/source-changes/2023/09/22/msg147669.html