CVE-2005-1240: Directory traversal vulnerability in the third party tool from Castlehill, as used to secure the iSeries AS...

Security readout for executives and security teams

This is an old IBM i/AS/400 FTP security bypass involving a Castlehill third-party security tool. A remote user could request files outside intended directories and read arbitrary files, including qsys.lib content. The sources do not provide CVSS, affected versions, or a named fix, so urgency depends on whether this legacy FTP protection remains deployed. Exposure is most likely in legacy IBM i/iSeries AS/400 environments running FTP with the referenced Castlehill third-party security product. The bundle does not identify exact product versions, CPEs, or other affected vendors, so confirmation requires asset and configuration review. Treat as an exposure-discovery priority for legacy IBM i estates. If internet-facing FTP or sensitive libraries are reachable through the affected tool, escalate remediation quickly; otherwise track through legacy risk reduction and vendor-support review. Mitigation focus: Identify IBM i/iSeries systems exposing FTP and using Castlehill FTP security tooling.; Check Castlehill or successor vendor guidance for fixed versions or supported replacements.; Restrict FTP access to trusted networks or disable it where not required..

Prepared

Jun 29, 2026, 22:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.