PT-2011-3230 · Pure Ftpd · Pure-Ftpd

Publicado 2011-05-23 · Atualizado 2014-02-21 · CVE-2011-1575

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pure-FTPd versions prior to 1.0.30

Description The issue is related to a "plaintext command injection" attack, where man-in-the-middle attackers can insert commands into encrypted FTP sessions. This occurs because the STARTTLS implementation does not properly restrict I/O buffering, allowing attackers to send a cleartext command that is processed after TLS is in place.

Recommendations For versions prior to 1.0.30, update to version 1.0.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP server until the update is applied.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2011-1575

Produtos afetados

Pure-Ftpd

Referências · 18

• https://github.com/jedisct1/pure-ftpd/commit/65c4d4ad331e94661de763e9b5304d28698999c4 · Correção
• https://security-tracker.debian.org/tracker/CVE-2011-1575 · Aviso do Fabricante
• http://secunia.com/advisories/43988 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/04/11/14 · Nota
• http://openwall.com/lists/oss-security/2011/04/11/7 · Nota
• http://archives.pureftpd.org/archives.cgi?100:mss:3906:201103:cpeojfkblajnpinkeadd · Nota
• http://archives.pureftpd.org/archives.cgi?100:mss:3910:201103:cpeojfkblajnpinkeadd · Correção
• https://bugzilla.redhat.com/show_bug.cgi?id=683221 · Nota
• http://secunia.com/advisories/44548 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1575 · Nota de Segurança
• http://openwall.com/lists/oss-security/2011/04/11/3 · Nota
• https://bugzilla.novell.com/show_bug.cgi?id=686590 · Correção
• http://pureftpd.org/project/pure-ftpd/news · Nota
• https://osv.dev/vulnerability/CVE-2011-1575 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1575 · Aviso do Fabricante