4

I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits.

The server I am working on has vsftpd 2.0.5 (set up by my supervisor-head administrator), and I am just worried that someone might be able to attack the server...

If there is any known exploit, can anyone provide me with the known links to public exploits? (so that I may make some vulnerability assessment.)

Leo Zacchov
  • 41
  • 1
  • 1
  • 2
  • 1
    When you say that there are no public exploits, where are you looking? A google search brings up results. – schroeder Aug 04 '12 at 19:46

2 Answers2

5

Exploit-db finds 3 exploits (click link). 1 for that specific version and 2 for higher versions.

OSVDB shows 11 exploits however you have to click each ID to see which version the exploits are for.

cve.mitre.org also reports 11 exploits. Versions are listed in the description. There are some there specific for 2.0.5.

Chris Dale
  • 16,119
  • 10
  • 56
  • 97
1

  1. As far as I know there is no as such serious exploit for vsFTPD version 2.0.5 which would allow an attacker to gain access or allow arbitrary code execution, instead I would suggest you to check if this service some how helps attackers to gain juicy information.

  2. Enumerate users, in old ftp versions I have noticed the anonymous accounts are enabled, when you login using anonymous accounts the ftp daemon sometimes leak's original application version and check if that version is vulnerable to any exploit, also check if any other such accounts are working or any other accounts are having weak passwords which can be bruteforced easily.

user2425057
  • 73
  • 4