SFTPPlus Release 3.28.0
We are pleased to announce the latest release of SFTPPlus version 3.28.0.
New Features
- It is now possible to set permission for file management operations for accounts authenticated with the FTP/FTPS service. [ftp][ftps][server-side] [#3399]
- You can now implement custom event handlers using our Python based …
SFTPPlus Release 3.27.0
We are pleased to announce the latest release of SFTPPlus version 3.27.0.
New Features
- It is now possible to define the expiration date and time when configuring an account of type application or OS. [server-side] [#1152]
- An audit event is now emitted when the HTTP connection is made …
Security Advisory for SFTPPlus 3.21.0
A security advisory was created for SFTPPlus version 3.21.0 affecting Linux and Unix systems authenticating operating system accounts over FTP.
Security Advisory for SFTPPlus 3.18.0
A security advisory was created for SFTPPlus version 3.18.0 affecting Linux and Unix systems that rely on the umask functionality.
SFTPPlus 3.6.0 Release
We are pleased to announce the latest release of SFTPPlus, version 3.6.0.
Here is the list of the important new functionalities:
- The OpenSSL version used by SFTPPlus is advertised as part of the events generated when starting the SFTPPlus process, as well as in the Local Manager status …
The DROWN Attack and SFTPPlus
SFTPPlus Server versions 1.6 and newer are not vulnerable to the DROWN attack.
SFTPPlus versions 3 and newer are also not vulnerable to it.
The DROWN attack targets server-side products, thus SFTPPlus client is not vulnerable to it.
SFTPPlus relies on OpenSSL for the …
SSLv3 POODLE vulnerability and SFTPPlus
Issue
In late September, a team at Google discovered a serious vulnerability in SSL 3.0, known as “POODLE”.
By exploiting this vulnerability, an attacker can gain access to data send over what is supposed to be a secured connection.
Affected protocols
SFTPPlus Server and Client are affected by SSLv3 …
OpenSSL Heartbleed bug and SFTPPlus
SFTPPlus uses OpenSSL only for FTPS protocol. SFTP protocol is not affected by this bug.
On Unix and Linux, SFTPPlus software use the OpenSSL library provided by the operating system. Unix and Linux operating system supported by SFTPPlus (RHEL 4, RHEL5, RHEL6, SLES 11, AIX 5.3) are not affected …
Security vulnerability for SSH keys authentication
Monday, 22 April 2013 - we have discovered a security vulnerability affecting SFTPPlus Server version 1.6, 1.7 and 1.8.
Due to an error in checking the SSH key signature, when SSH key authentication is used for a SFTP transfer, a user can obtain server access by using only …
OpenSSL DER certificate vulnerability and SFTPPlus
Last week a bug was discovered in all OpenSSL version. This bug can cause various security issues.
More information about the original vulnerability report for OpenSSL can be found from National Cyber Awareness System
A fix was already provided by the OpenSSL team as of 24 of April 2012.
Please …