Improper privilege management in ProFTPD - CVE-2024-48651

Vulnerability identifier: #VU101665

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N]

CVE-ID: CVE-2024-48651

CWE-ID: CWE-269

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to improper privilege management when handling users without assigned supplementary groups. If the user has no groups assigned to their account, the server will assume the GID of 0 for this account. As a result, the user will gain access to files and directories owned by the system root user and will be able to modify them at will, leading to privilege escalation and system compromise.

ProFTPD
Debian Linux
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
proftpd-basic (Ubuntu package)
proftpd-core (Ubuntu package)
proftpd
proftpd-utils
proftpd-sqlite
proftpd-postgresql
proftpd-mysql
proftpd-ldap
proftpd-devel
proftpd-debugsource
proftpd-debuginfo
proftpd-lang
proftpd-radius
proftpd-mysql-debuginfo
proftpd-ldap-debuginfo
proftpd-pgsql
proftpd-pgsql-debuginfo
proftpd-sqlite-debuginfo
proftpd-doc
proftpd-radius-debuginfo
proftpd-dfsg (Debian package)

Install update from vendor's website.

ProFTPD - addressed in versions 1.3.8c, 1.3.9 rc3
proftpd-basic (Ubuntu package) - addressed in versions 1.3.6c-2ubuntu0.1, 1.3.7c+dfsg-1ubuntu0.1
proftpd-core (Ubuntu package) - addressed in versions 1.3.7c+dfsg-1ubuntu0.1, 1.3.8.b+dfsg-1ubuntu0.1, 1.3.8.b+dfsg-2ubuntu1.24.10.1
proftpd - update to 1.3.8b-3
proftpd-utils - update to 1.3.8b-3
proftpd-sqlite - update to 1.3.8b-3
proftpd-postgresql - update to 1.3.8b-3
proftpd-mysql - update to 1.3.8b-3
proftpd-ldap - update to 1.3.8b-3
proftpd-devel - update to 1.3.8b-3
proftpd-debugsource - update to 1.3.8b-3
proftpd-debuginfo - update to 1.3.8b-3
proftpd-lang - update to 1.3.8b-150600.13.6.1
proftpd-debuginfo - update to 1.3.8b-150600.13.6.1
proftpd-radius - update to 1.3.8b-150600.13.6.1
proftpd - update to 1.3.8b-150600.13.6.1
proftpd-ldap - update to 1.3.8b-150600.13.6.1
proftpd-mysql-debuginfo - update to 1.3.8b-150600.13.6.1
proftpd-mysql - update to 1.3.8b-150600.13.6.1
proftpd-ldap-debuginfo - update to 1.3.8b-150600.13.6.1
proftpd-debugsource - update to 1.3.8b-150600.13.6.1
proftpd-pgsql - update to 1.3.8b-150600.13.6.1
proftpd-pgsql-debuginfo - update to 1.3.8b-150600.13.6.1
proftpd-sqlite-debuginfo - update to 1.3.8b-150600.13.6.1
proftpd-doc - update to 1.3.8b-150600.13.6.1
proftpd-radius-debuginfo - update to 1.3.8b-150600.13.6.1
proftpd-devel - update to 1.3.8b-150600.13.6.1
proftpd-sqlite - update to 1.3.8b-150600.13.6.1
proftpd-dfsg (Debian package) - update to 1.3.8+dfsg-4+deb12u4

• https://github.com/proftpd/proftpd/commit/cec01cc0a2523453e5da5a486bc6d977c3768db1
• https://github.com/proftpd/proftpd/issues/1830

• Privilege escalation in ProFTPD
• Debian update for proftpd-dfsg
• openEuler update for proftpd
• Ubuntu update for proftpd-dfsg
• SUSE update for proftpd