NVD

Id
8456  
Name
CVE-2011-1526  
Description
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-07-11  
Modified Date
2012-01-18  
Seq
2011-1526  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
48492 8456 CVE-2011-1526 FEDORA-2011-9080  View
48493 8456 CVE-2011-1526 FEDORA-2011-9109  View
48494 8456 CVE-2011-1526 openSUSE-SU-2011:1169  View
48495 8456 CVE-2011-1526 SUSE-SU-2012:0010  View
48496 8456 CVE-2011-1526 SUSE-SU-2012:0018  View
48497 8456 CVE-2011-1526 openSUSE-SU-2012:0019  View
48498 8456 CVE-2011-1526 SUSE-SU-2012:0042  View
48499 8456 CVE-2011-1526 SUSE-SU-2012:0050  View
48500 8456 CVE-2011-1526 openSUSE-SU-2012:0051  View
48501 8456 CVE-2011-1526 8301  View
48502 8456 CVE-2011-1526 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt  View
48503 8456 CVE-2011-1526 DSA-2283  View
48504 8456 CVE-2011-1526 MDVSA-2011:117  View
48505 8456 CVE-2011-1526 RHSA-2011:0920  View
48506 8456 CVE-2011-1526 20110705 MITKRB5-SA-2011-005 FTP daemon fails to set effective group ID [CVE-2011-1526]  View
48507 8456 CVE-2011-1526 48571  View
48508 8456 CVE-2011-1526 kerberos-krb5appl-priv-esc(68398)  View
48509 8456 CVE-2011-1526 https://bugzilla.redhat.com/show_bug.cgi?id=711419  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31655 JVNDB-2011-001895 MIT Kerberos 5 の GSS-API FTP デーモンにおけるグループのアクセス制限を回避される脆弱性 MIT Kerberos 5 の GSS-API FTP デーモン内の ftpd.c は、krb5_setegid の戻り値をチェックしないため、グループのアクセス制限を回避されることで、ファイルを作成、上書き、削除、または読み込まれる脆弱性が存在します。 CVE-2011-1526 49433 CVE-2011-1526 8456 6.5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001895.html 2011-07-05 2011-07-20 View