CVEvulnerability
CVE-2011-1526
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-07-11
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-269
Description
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
Affected configurations
• mit krb5-appl (< 1.0.1)
• debian debian linux 5.0
• debian debian linux 6.0
• fedoraproject fedora 14
• fedoraproject fedora 15
• opensuse opensuse 11.3
• opensuse opensuse 11.4
• suse linux enterprise desktop 10
• suse linux enterprise desktop 11
• suse linux enterprise server 10
• suse linux enterprise server 11
• suse linux enterprise software development kit 10
• suse linux enterprise software development kit 11
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html Mailing List, Third Party Advisory
- http://secunia.com/advisories/45145 Third Party Advisory
- http://secunia.com/advisories/45157 Third Party Advisory
- http://secunia.com/advisories/48101 Third Party Advisory
- http://securityreason.com/securityalert/8301 Third Party Advisory
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt Patch, Vendor Advisory
- http://www.debian.org/security/2011/dsa-2283 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:117 Third Party Advisory
- http://www.osvdb.org/73617 Broken Link
- http://www.redhat.com/support/errata/RHSA-2011-0920.html Third Party Advisory
- http://www.securityfocus.com/archive/1/518733/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/48571 Patch, Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=711419 Issue Tracking, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68398 Third Party Advisory, VDB Entry
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html Mailing List, Third Party Advisory
- http://secunia.com/advisories/45145 Third Party Advisory
- http://secunia.com/advisories/45157 Third Party Advisory
- http://secunia.com/advisories/48101 Third Party Advisory
- http://securityreason.com/securityalert/8301 Third Party Advisory
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt Patch, Vendor Advisory
- http://www.debian.org/security/2011/dsa-2283 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:117 Third Party Advisory
- http://www.osvdb.org/73617 Broken Link
- http://www.redhat.com/support/errata/RHSA-2011-0920.html Third Party Advisory
- http://www.securityfocus.com/archive/1/518733/100/0/threaded Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/48571 Patch, Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=711419 Issue Tracking, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68398 Third Party Advisory, VDB Entry