CVE-2011-1526
Medium
Description
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Mit Krb5-appl
PublishedJul 11, 2011
First seenJul 11, 2011
How to fix
Update
- mit krb5-appl1.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit krb5-appl | v < 1.0.1 | 1.0.1 |
| debian debian_linux | 5.0, 6.0 | — |
| fedoraproject fedora | 14, 15 | — |
| opensuse opensuse | 11.3, 11.4 | — |
| suse linux_enterprise_desktop | 10, 11 | — |
| suse linux_enterprise_server | 10, 11 | — |
| suse linux_enterprise_software_development_kit | 10, 11 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.