CVE-2017-7418

Published: 4 April 2017

ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
proftpd-dfsg Launchpad, Ubuntu, Debian	artful	Ignored (end of life)
	bionic	Not vulnerable (1.3.5e-1build1)
	cosmic	Not vulnerable (1.3.5e-1build1)
	disco	Not vulnerable (1.3.5e-1build1)
	eoan	Not vulnerable (1.3.5e-1build1)
	focal	Not vulnerable (1.3.5e-1build1)
	groovy	Not vulnerable (1.3.5e-1build1)
	hirsute	Not vulnerable (1.3.5e-1build1)
	impish	Not vulnerable (1.3.5e-1build1)
	jammy	Not vulnerable (1.3.5e-1build1)
	kinetic	Not vulnerable (1.3.5e-1build1)
	lunar	Not vulnerable (1.3.5e-1build1)
	mantic	Not vulnerable (1.3.5e-1build1)
	precise	Ignored (end of life)
	trusty	Does not exist (trusty was needed)
	upstream	Released (1.3.5b-4)
	xenial	Needed
	yakkety	Ignored (end of life)
	zesty	Ignored (end of life)

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›