CVE-2017-7418

{"id": "CVE-2017-7418", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2017-04-04T17:59:00.337", "references": [{"url": "http://bugs.proftpd.org/show_bug.cgi?id=4295", "tags": ["Issue Tracking", "Patch"], "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/97409", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/proftpd/proftpd/commit/ecff21e0d0e84f35c299ef91d7fda088e516d4ed", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/proftpd/proftpd/commit/f59593e6ff730b832dbe8754916cb5c821db579f", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/proftpd/proftpd/pull/444/commits/349addc3be4fcdad9bd4ec01ad1ccd916c898ed8", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://bugs.proftpd.org/show_bug.cgi?id=4295", "tags": ["Issue Tracking", "Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/97409", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/proftpd/proftpd/commit/ecff21e0d0e84f35c299ef91d7fda088e516d4ed", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/proftpd/proftpd/commit/f59593e6ff730b832dbe8754916cb5c821db579f", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/proftpd/proftpd/pull/444/commits/349addc3be4fcdad9bd4ec01ad1ccd916c898ed8", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user."}, {"lang": "es", "value": "ProFTPD en versiones anteriores a 1.3.5e y 1.3.6 en versiones anteriores a 1.3.6rc5 controlan si el directorio de inicio de un usuario puede contener un enlace simb\u00f3lico hasta la versi\u00f3n de la opci\u00f3n de configuraci\u00f3n AllowChrootSymlinks, pero comprueba s\u00f3lo el \u00faltimo componente de ruta al aplicar AllowChrootSymlinks. Los atacantes con acceso local pueden omitir el control AllowChrootSymlinks reemplazando un componente de ruta (que no sea el \u00faltimo) con un enlace simb\u00f3lico. El modelo de amenaza incluye un atacante al que no se concede acceso completo al sistema de archivos por parte de un proveedor de alojamiento, pero puede reconfigurar el directorio de inicio de un usuario FTP."}], "lastModified": "2024-11-21T03:31:51.593", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:proftpd:proftpd:*:d:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17E56F7D-3F37-44E2-9ADB-24F06125A5A4", "versionEndIncluding": "1.3.5"}, {"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40A2C657-27EB-475E-9591-99E03DBDA12B"}, {"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.6:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6475817-8CC7-4C0C-A9A6-E58189852DA2"}, {"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.6:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84CB8C28-C432-4FD4-9B76-CA6C2C8824D9"}, {"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.6:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21D053B1-AFDE-4859-ACFB-C51DC28EAA04"}, {"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.6:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA9A0785-FF92-4AB0-8F42-9060FB24120E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}