CVEvulnerability

CVE-2001-1500

7.5 HIGH Published 2001-12-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2001-12-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged.

Affected configurations

• proftpd project proftpd 1.2 • proftpd project proftpd 1.2.0 rc3 • proftpd project proftpd 1.2.1 • proftpd project proftpd 1.2.2 • proftpd project proftpd 1.2.2 rc1 • proftpd project proftpd 1.2.2 rc2 • proftpd project proftpd 1.2 pre1 • proftpd project proftpd 1.2 pre2 • proftpd project proftpd 1.2 pre3 • proftpd project proftpd 1.2 pre4 • proftpd project proftpd 1.2 pre5 • proftpd project proftpd 1.2 pre6 • proftpd project proftpd 1.2 pre7 • proftpd project proftpd 1.2 pre8 • proftpd project proftpd 1.2 pre9 • proftpd project proftpd 1.2 pre10 • proftpd project proftpd 1.2 pre11

Related

Referenced by CWE · observed example (1)

  • CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action weakness

References