PT-2017-17724 · Proftpd+2 · Proftpd+2

Published 2017-04-04 · Updated 2024-10-14 · CVE-2017-7418

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.5e ProFTPD versions 1.3.6 prior to 1.3.6rc5

Description The issue allows attackers with local access to bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. This could be exploited by an attacker who is not granted full filesystem access but can reconfigure the home directory of an FTP user.

Recommendations For ProFTPD versions prior to 1.3.5e, update to version 1.3.5e or later. For ProFTPD versions 1.3.6 prior to 1.3.6rc5, update to version 1.3.6rc5 or later.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2018-1000

ALT-PU-2021-2692

ALT-PU-2023-5874

ALT-PU-2024-13729

CVE-2017-7418

MGASA-2017-0115

OPENSUSE-SU-2019:1836-1

OPENSUSE-SU-2019:1870-1

OPENSUSE-SU-2019_1836-1

OPENSUSE-SU-2020:0031-1

OPENSUSE-SU-2020_0031-1

OPENSUSE-SU-2024:11196-1

Affected Products

Alt Linux

Proftpd

Suse

References · 75

• 🔥 https://github.com/ptef/CVE-2020-9273 · Exploit
• 🔥 https://github.com/KTN1990/CVE-2019-12815 · Exploit
• https://github.com/proftpd/proftpd/pull/444/commits/349addc3be4fcdad9bd4ec01ad1ccd916c898ed8 · Patch
• https://github.com/proftpd/proftpd/commit/f59593e6ff730b832dbe8754916cb5c821db579f · Patch
• https://github.com/proftpd/proftpd/commit/ecff21e0d0e84f35c299ef91d7fda088e516d4ed · Patch
• https://bdu.fstec.ru/vul/2020-05776 · Security Note
• https://bdu.fstec.ru/vul/2025-13444 · Security Note
• https://bdu.fstec.ru/vul/2019-04710 · Security Note
• https://bdu.fstec.ru/vul/2023-05663 · Security Note
• https://advisories.mageia.org/MGASA-2017-0115.html · Security Note
• https://bdu.fstec.ru/vul/2025-13442 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/628288 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7418 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2024-13729 · Vendor Advisory