FTP accounts with no password

Vulnerability Description

Brief description: There are accounts that have FTP access to the system with no passwords.

Full description: There are accounts that have FTP access to the system with no passwords. This may include the anonymous FTP account. If this is considered a vulnerability on the system, it is administrative in nature.

There are several possible causes. One is not restricting FTP access to accounts that need FTP access. This includes not restricting access by system accounts such as

Another possible cause is not requiring users to have passwords.

A third is having the

Components: ftpd, wftp

Systems: Windows NT 3.51 ny system running ftp

Effect(s) of exploiting: Anybody could use an account with no password.

Detecting the hole:

1. 1. Enumerate the accounts that have FTP access by examining the access controls associated with the daemon.
   2. For each account with FTP accesss, try to log in without a password.

Fixing the hole:

1. 1. Modify the relevant access controls to restrict access to the accounts that should have access and no more. For example, add the account names to /etc/ftpusers .
   2. Educate the owners of those accounts with no passwords about the risk to the system accounts with no passwords create.

Other information:

Keywords

ftp password

Cataloguing

CVE Number: CAN-1999-0200 -- Windows NT FTP server (WFTP) with the guest account enabled without a password allows an attacker to log into the FTP server using any username and password.

Exploit Information

Attack:

Related Information

Advisories: The Windows NT 3.51 vulnerability is described in Microsoft Knowledge Base Article Q137853, Guest Account Allows FTP Users Access Without Authentication .

Related Vulnerabilities:

Reportage

Reporting: in ( )

Revision Number 1

1. Patrick LeBlanc (7/5/2000):
   Initial entry