PT-2018-2667 · Lftp+5 · Lftp+5

Tomsommero · Published 2018-08-01 · Updated 2024-06-15 · CVE-2018-10916

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions lftp versions up to and including 4.8.3

Description The issue arises from lftp's failure to properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user into using reverse mirroring on an attacker-controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system. This is due to insufficient input validation in the console FTP client.

Recommendations For lftp versions up to and including 4.8.3, avoid using reverse mirroring with untrusted FTP servers to minimize the risk of exploitation. As a temporary workaround, consider restricting the use of reverse mirroring until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-2263

BDU:2019-01302

CESA-2020_1045

CVE-2018-10916

OPENSUSE-SU-2019:1110-1

OPENSUSE-SU-2019_1059-1

OPENSUSE-SU-2019_1110-1

OPENSUSE-SU-2024:10915-1

RHSA-2020:1045

RHSA-2020_1045

SUSE-SU-2019:0642-1

SUSE-SU-2019:0643-1

SUSE-SU-2019_0642-1

SUSE-SU-2019_0643-1

USN-3731-1

USN-3731-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Lftp

References · 31

• 🔥 https://github.com/lavv17/lftp/issues/452 · Exploit
• https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-10916 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0643-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1110-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-10916 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3731-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-10916 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00010.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10916 · Vendor Advisory
• https://usn.ubuntu.com/3731-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-10916 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10915-1 · Vendor Advisory