Ipswitch Ws_ftp 12 Download ##TOP##
Athenna Jimenez
One of our customer has very old ws_ftp setup (ver 7.1) and they decided to perform migration to another FTP server solution. As I told before, it is very old setup with 200+ users, who are not documented. Ftp is extensively used, so customer decided to analyze logs for last year and maybe clean some of the users and inform others about future changes in FTP setup. There are 2 ways to get a logs:
Start by doing a search on your computer for "original.ini" and "ws_ftp.ini". When you find these files, please open them and verify that your site information is listed. If so, you will want to copy the files from the old PC to the new PC and paste them in the appropriate directory (see below for options).
A vulnerability classified as critical has been found in Ipswitch WS_FTP Server up to 8.6.0 (File Transfer Software). Affected is an unknown code block in the library SSHServerAPI.dll. The manipulation as part of a SITE Command leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the SITE command feature.
The weakness was released 06/11/2019 (Website). The advisory is available at docs.ipswitch.com. This vulnerability is traded as CVE-2019-12144 since 05/16/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.
Its configuration files are in a system-dependent location, but for WS_FTP Professional 2007 or WS_FTP 12 running in Windows XP, 7, 8, or 10, its configuration files are generally found in c:\Users\username\AppData\Roaming\Ipswitch\WS_FTP and its subdirectories. The file wirh the site setup is located in the Sites subdirectory as ws_ftp.ini. If multiple folders are used to group sites, each folder has a separate .ini file also in the Sites subdirectory.
df19127ead