PT-2011-1084 · Pure Ftpd · Pure-Ftpd

Publicado 2011-11-04 · Atualizado 2017-08-29 · CVE-2011-3171

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions pure-FTPd version 1.0.22 pure-FTPd (affected versions not specified, possibly other versions)

Description The issue allows local users to overwrite arbitrary files via unknown vectors when the Netware OES remote server feature is enabled. This can lead to a breach of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be performed locally.

Recommendations For pure-FTPd version 1.0.22, consider disabling the Netware OES remote server feature until a patch is available. For other possibly affected versions of pure-FTPd, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2015-04621

CVE-2011-3171

Produtos afetados

Pure-Ftpd

Referências · 6

• https://bdu.fstec.ru/vul/2015-04621 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00015.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-3171 · Nota de Segurança
• http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00016.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69686 · Nota
• http://securityfocus.com/bid/49541 · Nota