CVE-2015-3306

Опубликовано: 18 мая 2015

Источник: nvd

CVSS3: 10

CVSS2: 10

EPSS Критический

Описание

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
Broken Link
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
Broken Link
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
Broken Link
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
Exploit
VDB Entry
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html
Exploit
VDB Entry
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html
Exploit
VDB Entry
http://www.debian.org/security/2015/dsa-3263
Mailing List
Third Party Advisory
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
Third Party Advisory
http://www.securityfocus.com/bid/74238
Third Party Advisory
https://www.exploit-db.com/exploits/36742/
Exploit
https://www.exploit-db.com/exploits/36803/
Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
Broken Link
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
Broken Link
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
Broken Link
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
Mailing List
Third Party Advisory
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:opensuse:tumbleweed:-:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:-:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:sap:*:*

Конфигурация 4

cpe:2.3:a:proftpd:proftpd:1.3.5:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.99497

Критический

10 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-284

Связанные уязвимости

CVE-2015-3306

CVSS3: 10

ubuntu

больше 11 лет назад

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

CVE-2015-3306

CVSS3: 10

debian

больше 11 лет назад

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read a ...

GHSA-4mfj-5wr8-x32q

CVSS3: 10

github

больше 4 лет назад

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

BDU:2015-10225

fstec

больше 11 лет назад

Уязвимость FTP-сервера ProFTPD, позволяющая удалённому нарушителю получить доступ к защищаемой информации

ALT-PU-2019-2329

CVSS3: 10

altlinux

больше 7 лет назад

ALT-PU-2019-2329: package `proftpd` update to version 1.3.6-alt0.1.ga73dbfe3b

EPSS

Процентиль: 100%

0.99497

Критический

10 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-284