| VID |
16039 |
| Severity |
40 |
| Port |
21 |
| Protocol |
TCP |
| Class |
FTP |
| Detailed Description |
The 'guest' FTP account is accessible through the FTP service. This is usually not a good thing, since very often, this account will not run in a restricted environment, so an attacker will be very likely to use it to break into this system.
* Platforms Affected:
FTP Server Any version
Microsoft Windows Any version
* References:
http://www.iss.net/security_center/static/39.php |
| Recommendation |
Disable the guest account or change the password to something difficult to guess.
For the Unix:
If it is not needed, delete this Unix account. or change the password to something difficult to guess using "passwd" command.
For the Windows NT:
1. Open User Manager. From the Windows NT Start menu, select Programs, Administrative Tools (Common), and User Manager.
2. Double-click the account to display the User Properties dialog box.
3. To change the password to something difficult to guess, type and confirm the new password. And To disable the account, select the Account Disabled check box.
4. Click OK.
For the Windows 2000:
1. Open "Control Panel" under Settings from the Windows 2000 Start menu.
2. Double-click Administrative Tools (Common), and Computer Manager.
3. Click the Plus sign to the left of the Local Users and Groups icon.
4. Click the Users folder and right-click the account named Guest.
5. To change the password to something difficult to guess, choose "Set Password" from the pop up menu and enter a strong password. And To disable the account, choose "Properties" from the pop up menu and select the Account Disabled check box.
6. Click OK.
For Windows XP, 2003, VISTA, 7, 2008, 8, 2012, 10, 2016, 2019:
1. Open "Control Panel" -> User Accounts -> "Change an account" or "Manage Accounts"
2. To disable Guest account, select the Account Disabled check box. |
| Related URL |
CVE-1999-0200,CVE-1999-0156 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
