CVE-2004-1948: Medium severity ncftp software ncftp vulnerability
Published Apr 20, 2004
·Updated
NcFTP client 3.1.6 and 3.1.7, when the username and password are included in an FTP URL that is provided on the command line, allows local users to obtain sensitive information via "ps aux," which displays the URL in the process list.
Affected Software
13 affected components
Ncftp Software Ncftp=3.0.2
Ncftp Software Ncftp=3.1.3
Ncftp Software Ncftp=3.1.4
Ncftp Software Ncftp=3.0.0
Ncftp Software Ncftp=3.1.0
Ncftp Software Ncftp=3.0.3
Ncftp Software Ncftp=3.1.6
Ncftp Software Ncftp=3.1.5
Ncftp Software Ncftp=3.1.7
Ncftp Software Ncftp=3.1.1
Ncftp Software Ncftp=3.0.1
Ncftp Software Ncftp=3.1.2
Ncftp Software Ncftp=3.0.4
Event History
Apr 20, 2004
CVE Published
04:00 AM
May 10, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-1948?
CVE-2004-1948 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2004-1948?
To mitigate CVE-2004-1948, upgrade to a version of NcFTP that does not expose sensitive information in process listings.
3
Which versions of NcFTP are affected by CVE-2004-1948?
CVE-2004-1948 affects NcFTP versions 3.1.6 and 3.1.7.
4
What types of sensitive information can be exposed due to CVE-2004-1948?
CVE-2004-1948 can expose FTP usernames and passwords included in the command line FTP URLs.
5
Can local users exploit CVE-2004-1948?
Yes, local users can exploit CVE-2004-1948 to obtain sensitive information via the process list.