Advisory - FTP Rush

Overview

FTP Rush does not validate X.509 certificates, when FTP with TLS is used

Vulnerability Details

A user can not recognize an easy to perform man-in-the-middle attack, because the client does not validate the X.509 certificate from the FTP server. In an untrusted networking environment (like a Wifi hotspot), the current FTP AUTH TLS connection with FTP Rush should be classified as not encrypted.

Proof of Concept (PoC)

Not needed

Solution

Use another client for FTP with AUTH TLS

Disclosure Timeline

April 3, 2014 - Vulnerability discovered

April 4, 2014 - Vulnerability reported to vendor

May  19, 2014 - Vulnerability disclosure, after a period of 45 days for a responsible disclosure

Credits

Security vulnerability found by Micha Borrmann of the SySS GmbH.

Disclaimer

The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS web site.

Copyright

Creative Commons - Attribution (by) - Version 3.0

URL: creativecommons.org/licenses/by/3.0/deed.en