PT-2020-20567 · Pure Ftpd+1 · Pure-Ftpd+1

Antonio Norales · Published 2020-02-26 · Updated 2024-06-15 · CVE-2020-9274

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pure-FTPd version 1.0.49

Description An issue has been discovered related to an uninitialized pointer vulnerability in the diraliases linked list. The lookup alias(const char alias) or print aliases(void) function fails to correctly detect the end of the linked list, resulting in an attempt to access a non-existent list member. This issue is related to the init aliases function in diraliases.c.

Recommendations For Pure-FTPd version 1.0.49, consider disabling the lookup alias and print aliases functions as a temporary workaround until a patch is available. Restrict access to the diraliases linked list to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

CVE-2020-9274

DLA-2123-1

OPENSUSE-SU-2024:11773-1

ROSA-SA-2023-2188

USN-4515-1

Affected Products

Pure-Ftpd

Ubuntu

References · 23

• https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-9274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9274 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-9274 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B5NSUDWXZVWUCL6R2PTX3KBB42Z62CA5 · Vendor Advisory
• https://usn.ubuntu.com/4515-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9274 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4515-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-9274 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11773-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-9274 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22P44PECZWNDP7CMBL7NRBMNFS73C5Z2 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-54 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2123-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4515-1 · Vendor Advisory