Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2019:0643-1

Опубликовано: 19 мар. 2019
Источник: suse-cvrf

Описание

Security update for lftp

This update for lftp fixes the following issues: Security issue fixed:

  • CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367).

Other issue addressed:

  • The SSH login handling code detects password prompts more reliably (bsc#1120946).

Список пакетов

SUSE Linux Enterprise Module for Basesystem 15
lftp-4.8.3-4.3.1

Ссылки

Описание

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.

Затронутые продукты
SUSE Linux Enterprise Module for Basesystem 15:lftp-4.8.3-4.3.1
Ссылки