SB2011110405 - Path traversal in Pure-FTPd

Description

This security bulletin contains information about 1 security vulnerability.

1) Path traversal (CVE-ID: CVE-2011-3171)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating systems, when the Netware OES remote server feature is enabled,. A remote authenticated attacker can send a specially crafted HTTP request and local users to overwrite arbitrary files via unknown vectors.

Remediation

Install update from vendor's website.

References

• http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00016.html
• http://www.securityfocus.com/bid/49541
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69686