Description
The FTP server in HP-UX 10.20, B.11.00, and B.11.11, allows remote attackers to list arbitrary directories as root by running the LIST command before logging in.
References
- oval:org.mitre.oval:def:410 vdb-entry signature
- oval:org.mitre.oval:def:1472 vdb-entry signature
- http://www.frsirt.com/exploits/20051019.hpux_ftpd_preauth_list.pm.php
- oval:org.mitre.oval:def:767 vdb-entry signature
- oval:org.mitre.oval:def:615 vdb-entry signature
- oval:org.mitre.oval:def:1212 vdb-entry signature
- HPSBUX02071 vendor-advisory
- oval:org.mitre.oval:def:1276 vdb-entry signature
- oval:org.mitre.oval:def:1439 vdb-entry signature
- oval:org.mitre.oval:def:421 vdb-entry signature
- 15138 vdb-entry
- oval:org.mitre.oval:def:438 vdb-entry signature
- oval:org.mitre.oval:def:1029 vdb-entry signature
- oval:org.mitre.oval:def:593 vdb-entry signature
- 1015158 vdb-entry