PT-2015-1244 · Proftpd+1 · Proftpd+1

R-73En · Publicado 2015-05-18 · Atualizado 2026-03-10 · CVE-2015-3306

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ProFTPD version 1.3.5

Description The issue allows remote attackers to read and write to arbitrary files. This is achieved via the site cpfr and site cpto commands, which are part of the mod copy module in the ProFTPD FTP server.

Recommendations For ProFTPD version 1.3.5, consider disabling the mod copy module as a temporary workaround until a patch is available. Restrict access to the site cpfr and site cpto commands to minimize the risk of exploitation.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2019-2329

ALT-PU-2019-2647

BDU:2015-10225

CVE-2015-3306

DSA-3263-1

OPENSUSE-SU-2024:10048-1

Produtos afetados

Alt Linux

Proftpd

Referências · 41

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb · Exploit
• 🔥 https://github.com/t0kx/exploit-CVE-2015-3306 · Exploit
• 🔥 https://github.com/nootropics/propane · Exploit
• 🔥 https://exploit-db.com/exploits/36803 · Exploit
• 🔥 https://exploit-db.com/exploits/36742 · Exploit
• 🔥 https://exploit-db.com/exploits/49908 · Exploit
• 🔥 https://exploit-db.com/exploits/37262 · Exploit
• https://suse.com/security/cve/CVE-2009-0543 · Nota
• https://cxsecurity.com/issue/WLB-2015040075 · Nota
• http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-3306 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10048-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-3306 · Aviso do Fabricante
• http://rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec · Nota
• http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html · Nota