PT-2011-3230 · Pure Ftpd · Pure-Ftpd

Published 2011-05-23 · Updated 2014-02-21 · CVE-2011-1575

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pure-FTPd versions prior to 1.0.30

Description The issue is related to a "plaintext command injection" attack, where man-in-the-middle attackers can insert commands into encrypted FTP sessions. This occurs because the STARTTLS implementation does not properly restrict I/O buffering, allowing attackers to send a cleartext command that is processed after TLS is in place.

Recommendations For versions prior to 1.0.30, update to version 1.0.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP server until the update is applied.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2011-1575

Affected Products

Pure-Ftpd

References · 18

• https://github.com/jedisct1/pure-ftpd/commit/65c4d4ad331e94661de763e9b5304d28698999c4 · Patch
• https://security-tracker.debian.org/tracker/CVE-2011-1575 · Vendor Advisory
• http://secunia.com/advisories/43988 · Vendor Advisory
• http://archives.pureftpd.org/archives.cgi?100:mss:3910:201103:cpeojfkblajnpinkeadd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-1575 · Security Note
• https://bugzilla.novell.com/show_bug.cgi?id=686590 · Patch
• https://osv.dev/vulnerability/CVE-2011-1575 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1575 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/04/11/14 · Note
• http://openwall.com/lists/oss-security/2011/04/11/7 · Note
• http://archives.pureftpd.org/archives.cgi?100:mss:3906:201103:cpeojfkblajnpinkeadd · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=683221 · Note
• http://secunia.com/advisories/44548 · Note
• http://openwall.com/lists/oss-security/2011/04/11/3 · Note