CVE-2011-1526

Опубликовано: 11 июл. 2011

Источник: nvd

CVSS2: 6.5

EPSS Низкий

Описание

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html
Mailing List
Third Party Advisory
http://secunia.com/advisories/45145
Third Party Advisory
http://secunia.com/advisories/45157
Third Party Advisory
http://secunia.com/advisories/48101
Third Party Advisory
http://securityreason.com/securityalert/8301
Third Party Advisory
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt
Patch
Vendor Advisory
http://www.debian.org/security/2011/dsa-2283
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:117
Third Party Advisory
http://www.osvdb.org/73617
Broken Link
http://www.redhat.com/support/errata/RHSA-2011-0920.html
Third Party Advisory
http://www.securityfocus.com/archive/1/518733/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/48571
Patch
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mit:krb5-appl:*:*:*:*:*:*:*:*

Версия до 1.0.1 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:-:vmware:*:*

cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.00228

Низкий

6.5 Medium

CVSS2

Дефекты

CWE-269

Связанные уязвимости

CVE-2011-1526

ubuntu

почти 14 лет назад

CVE-2011-1526

redhat

почти 14 лет назад

CVE-2011-1526

debian

почти 14 лет назад

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Application ...

GHSA-qc9v-p4hp-c5fh

github

около 3 лет назад

ELSA-2012-0306

oracle-oval

больше 13 лет назад

ELSA-2012-0306: krb5 security and bug fix update (LOW)

EPSS

Процентиль: 46%

0.00228

Низкий

6.5 Medium

CVSS2

Дефекты

CWE-269