Security restrictions bypass in vsftpd - CVE-2015-1419
Published: August 15, 2016 / Updated: November 20, 2018
Vulnerability identifier: #VU310
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-1419
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to unknown error related to parsing of "deny_file" option. A remote authenticated attacker can bypass certain security restrictions and gain unauthorized access to protected files on the system.
Successful exploitation of the vulnerability may allow an authenticated attacker to bypass intended security restrictions.
Affected software
vsftpd
vsftpd (Alpine package)
cabextract (Alpine package)
vsftpd (Alpine package)
cabextract (Alpine package)
How to mitigate CVE-2015-1419
Install
the latest version 3.0.3 from vendor’s website.
vsftpd (Alpine package) - addressed in versions 3.0.2-r3, 3.0.2-r4, 3.0.2-r9, 3.0.3-r0, 3.0.3-r6
cabextract (Alpine package) - update to 1.9.1-r0
- update to 2.11-8ubuntu4
cabextract (Alpine package) - update to 1.9.1-r0
- update to 2.11-8ubuntu4