CVE-2019-12815
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3. ...
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media).
Descripción
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | proftpd-dfsg | 1.3.6-4+deb10u1 |
| debian 11 | proftpd-dfsg | 1.3.6-6 |
| debian 12 | proftpd-dfsg | 1.3.6-6 |
| debian 13 | proftpd-dfsg | 1.3.6-6 |
| debian 14 | proftpd-dfsg | 1.3.6-6 |
| debian 8 | proftpd-dfsg | 1.3.5e+r1.3.5-2+deb8u3 |
| debian 9 | proftpd-dfsg | 1.3.5b-4+deb9u1 |
| echo | proftpd-dfsg | 1.3.6-6 |
| ubuntu 18.04-ESM | proftpd-dfsg | sin corrección indicada |
Referencias
- http://bugs.proftpd.org/show_bug.cgi?id=4372
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html
- http://seclists.org/fulldisclosure/2024/Aug/35
- http://www.securityfocus.com/bid/109339
- https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf
- https://github.com/proftpd/proftpd/pull/816
Las 16 referencias
- https://lists.debian.org/debian-lts-announce/2019/08/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OJDQ3XUYWO42TJBO53NUWDZRA35QMVEI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XM5FPBAGSIKV6YJZEPM6GPGJO5JFT7XU/
- https://seclists.org/bugtraq/2019/Aug/3
- https://security.gentoo.org/glsa/201908-16
- https://tbspace.de/cve201912815proftpd.html
- https://www.cve.org/CVERecord?id=CVE-2019-12815
- https://www.debian.org/security/2019/dsa-4491