Description
JSCAPE Secure FTP Applet 4.8.0 and earlier does not ask the user to verify a new or mismatched SSH host key, which makes it easier for remote attackers to perform man-in-the-middle attacks.
References
- 20080623 n.runs-SA-2008.001 - Jscape Secure FTP Applet mailing-list
- 30822 third-party-advisory
- 29882 vdb-entry
- ADV-2008-1919 vdb-entry
- jscape-certificate-spoofing(43300) vdb-entry
- 1020346 vdb-entry
- http://www.jscape.com/sftpapplet/docs/HTML/index.html?introhistory.html
- 20080625 ERRATA - n.runs-SA-2008.001 - Jscape Secure FTP Applet mailing-list
- 4606 third-party-advisory