CVE-2011-1526

Published: Jul 11, 2011Modified: Apr 29, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.

Affected (16)

Products: Mit: Krb5 Appl · Debian: Debian Linux · Fedoraproject: Fedora · +2 more

Show all products

Mit: Krb5 Appl · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit

1 product

1 product

1 product

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mit Krb5 Appl	Before 1.0.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 14
Fedoraproject Fedora	Version 15

Configuration D

11 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.3
Opensuse Opensuse	Version 11.4
Suse Linux Enterprise Desktop	Version 10 sp4
Suse Linux Enterprise Desktop	Version 11 sp1
Suse Linux Enterprise Server	Version 10 sp2
Suse Linux Enterprise Server	Version 10 sp3
Suse Linux Enterprise Server	Version 10 sp4
Suse Linux Enterprise Server	Version 11 sp1
Suse Linux Enterprise Server	Version 11 sp1
Suse Linux Enterprise Software Development Kit	Version 10 sp4
Suse Linux Enterprise Software Development Kit	Version 11 sp1

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (44)

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html

Source: cve@mitre.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://secunia.com/advisories/45145

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/45157

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/48101

Source: cve@mitre.org

Third Party Advisory

http://securityreason.com/securityalert/8301

Source: cve@mitre.org

Third Party Advisory

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt

Source: cve@mitre.org

PatchVendor Advisory

http://www.debian.org/security/2011/dsa-2283

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:117

Source: cve@mitre.org

Third Party Advisory

http://www.osvdb.org/73617

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2011-0920.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/518733/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/48571

Source: cve@mitre.org

PatchThird Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=711419

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/68398

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html