by Patrick Mills | Apr 21, 2021 | FTP Server Security, News
Security Advisory Description Cerberus FTP Server uses OpenSSL. Our pseudo random number generator (PNRG) seeding process utilizes a number of methods and sources. OpenSSL supports Intel’s RDRAND instruction; on processors without this instruction (Intel before 3rd...
by Patrick Mills | Apr 21, 2021 | FTP Server Security
Security Advisory Description Cerberus FTP Server uses cURL in some Event Manager options. By default when linked with OpenSSL, cURL attempts to find openssl.cnf; the search will look at the system environment variables, Registry, or the default build location....
by Vincent Drake | Apr 5, 2021 | FTP Server Security
Security Advisory Cerberus FTP Server version 11.2.8 and higher include a number of security-related fixes we had not documented. Normally, we disclose security issues when we release a fix for the issue. In this case, a single customer reported all of the issues, so...
by Grant Averett | Apr 5, 2021 | FTP Server Administration, Informational
One of the more common requests we’ve received from customers since the introduction of version 11.0 is to reduce the amount of scrolling needed to administer users and groups. Vertical screen real estate tends to be at a premium. The top-down arrangement of the...
by Patrick Mills | Nov 17, 2020 | FTP Server Administration, Informational, News, Reporting
Cerberus FTP Server Enterprise edition offers the Report Manager for collecting detailed usage statistics and generating detailed reports. To use the Report Manager, administrators must first configure a reporting database. Cerberus integrates with a number of...
by Patrick Mills | Jul 22, 2020 | FTP Server Security
Security Advisory Description Cerberus FTP Server Enterprise and Professional versions prior to 11.2.5 and 10.0.26 are vulnerable to an extension blocking bypass over the SCP protocol. Scope This vulnerability impacts Cerberus FTP Server Enterprise and Cerberus FTP...
by Patrick Mills | Nov 17, 2020 | FTP Logs, FTP Server Administration, Informational, News
Cerberus FTP Server Version 11 added the IP address and username to every log statement that originates from a client connection. See how to enable this feature. Until now however, the Apache Log4cxx framework has lacked the ability to filter based on these fields. In...
by Vincent Drake | May 27, 2020 | FTP Server Administration
We are changing the way Cerberus FTP version 11.2.2 behaves when closing the Admin Console. The change is small, but may surprise long-time users. How it Used to Work Before 11.2.2, clicking the ‘close’ button or Alt-F4 to close Cerberus only hides the...
by Patrick Mills | Jul 20, 2020 | Automation, FTP Server Administration, Informational, News
We’ve introduced a highly requested new Transfer File Target in Event Manager that allows transferring files to other servers via SFTP, FTP, FTPS, or HTTP/S PUT in Cerberus FTP Server 11.2 Enterprise. While it’s been possible to send files using the “Launch an...
by Vincent Drake | Apr 22, 2020 | FTP Server Administration, FTP Server Security
Introduction Cerberus is receiving a security update with version 11.2 that administrators should review before upgrading. There is a small chance that the changes made may impact services, but we have provided an override setting to workaround any impact....
by Grant Averett | Mar 23, 2020 | FTP Logs, FTP Server Administration
We’ve introduced a new, continuous view in Cerberus FTP Server 11.1 for the Log Manager. This new view is now the default over the paged table view that we debuted with version 11.0. Some of the early feedback we received for Cerberus FTP Server 11 was that the new,...
by Vincent Drake | Jul 20, 2020 | FTP Server Security, Web Client
Security Advisory Description Cerberus FTP Server Enterprise Edition prior to versions 11.1.0 and 10.0.23 allow underprivileged WebClient users to view file names and folder names. Only the names of the files are exposed; the file contents are not exposed. A malicious...
by Grant Averett | Apr 1, 2020 | FTP Server Administration, Informational, News
We listened to your feedback about making the User Manager more intuitive, especially as it relates to creating new users and groups. With Cerberus FTP Server 11.1, we’ve introduced a new user and group guided creation wizard to more easily create new Cerberus users...
by Vincent Drake | Jan 27, 2020 | FTP Server Security
Security Advisory Description Cerberus FTP Server contains a flaw that may allow malformed HTTP requests to crash the service. Malicious actors could leverage this flaw to repeatedly crash the server, thereby denying access to legitimate users. Fix Cerberus FTP...
by Vincent Drake | Jun 6, 2023 | FTP Server Security
Security Advisory Description Cerberus FTP Server administrators have the option to block end-users from uploading certain file types, identified by file name extension. When end-users attempt to upload or rename files, they encounter a permission error if the target...
by Vincent Drake | Jun 7, 2023 | FTP Server Security
Security Advisory Description When customers preview SVG files in the Cerberus FTP Server Web Client, it executes any scripts embedded within the SVG file in the context of the end-user’s session. This exposes the user to malicious scripts that may hijack the...
by Patrick Mills | Dec 11, 2019 | FTP Server Security
Security Advisory Description Cerberus FTP Server Enterprise Edition prior to versions 11.0.3 and 10.0.18 are vulnerable to a permissions bypass when a user has zip/unzip permission. When zipping, users could zip files and folders that weren’t visible to them;...
by Jeff | Jan 8, 2020 | FTP Server Administration, Informational, News
You’ve been waiting and now it’s here: Cerberus FTP Server Version 11 is now available for new customers and active service agreement holders, with new features to keep your data and file transfers safe and secure. Cerberus FTP Server Version 11 offers the...
by Vincent Drake | Dec 11, 2019 | FTP Server Security
Security Advisory Description Cerberus FTP Server Enterprise Edition prior to versions 11.0.1 and 10.0.17 are vulnerable to a cross-site scripting (XSS) attack on Cerberus’ public share page. This XSS vulnerability allows a malicious public share to insert...
by Grant Averett | Dec 9, 2019 | FTP Server Administration, FTP Server Security
Security Advisory Description Cerberus FTP Server releases prior to 11.0.1 were vulnerable to brute force attacks for the 2FA code for a web client user or server administrator when using the Cerberus HOTP 2FA implementation. This vulnerability results from us...
