CVE-2015-3306

Published: May 18, 2015Modified: Oct 9, 2026CISA KEV

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Affected (10)

Products: Fedoraproject: Fedora · Debian: Debian Linux · Opensuse: Tumbleweed · +2 more

Show all products

Fedoraproject: Fedora · Debian: Debian Linux · Opensuse: Tumbleweed · Suse: Linux Enterprise Server · Proftpd: Proftpd

1 product

1 product

1 product

1 product

Linux Enterprise Server

Proftpd

1 product

Proftpd

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 20
Fedoraproject Fedora	Version 21
Fedoraproject Fedora	Version 22

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Tumbleweed	All versions
Suse Linux Enterprise Server	Version 15 sp7
Suse Linux Enterprise Server	Version 15 sp7

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Proftpd Proftpd	Version 1.3.5

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (29)

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html

Source: cve@mitre.org

Broken LinkMailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html

Source: cve@mitre.org

Broken LinkMailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html

Source: cve@mitre.org

Broken LinkMailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html

Source: cve@mitre.org

ExploitVDB Entry

http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html

Source: cve@mitre.org

ExploitVDB Entry

http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html

Source: cve@mitre.org

ExploitVDB Entry

http://www.debian.org/security/2015/dsa-3263

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/74238

Source: cve@mitre.org

Third Party Advisory

https://www.exploit-db.com/exploits/36742/

Source: cve@mitre.org

Exploit

https://www.exploit-db.com/exploits/36803/

Source: cve@mitre.org

Exploit

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html