Path traversal in Pure-FTPd - CVE-2011-3171

Detailed vulnerability description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating systems, when the Netware OES remote server feature is enabled,. A remote authenticated attacker can send a specially crafted HTTP request and local users to overwrite arbitrary files via unknown vectors.

How to mitigate CVE-2011-3171

Sources

• http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00016.html
• http://www.securityfocus.com/bid/49541
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69686