CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-12170
https://notcve.org/view.php?id=CVE-2017-12170
Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configuration was ignored after update and service started running with default configuration. This has security implications because of overriding security-related configuration. This issue doesn't affect upstream version of pure-ftpd. La versión downstream 1.0.46-1 de pure-ftpd, tal y como viene distribuido en Fedora, es vulnerable a los errores de empaquetado ya que se ignora la configuración original después de que se actualice y que el servicio empiece a ejecutarse con la configuración por defecto. Esto provoca un impacto en la seguridad por omitir configuraciones de seguridad. • https://bugzilla.redhat.com/show_bug.cgi?id=1493114 •
CVSS: 5.8EPSS: 89%CPEs: 87EXPL: 0CVE-2011-1575
https://notcve.org/view.php?id=CVE-2011-1575
The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411. La implementación de STARTTLS en ftp_parser.c de Pure-FTPd en versiones anteriores a 1.0.30 no restringe correctamente el buffer de entrada/salida, que permite a los atacantes a realizar "man-in-the-middle" para insertar comandos en las sesiones FTP cifradas mediante el envío de un comando en claro que se procesa después de TLS esté funcionando, se relaciona con una "inyección de comandos de texto claro" es un problema similar a CVE-2011-0411. • http://archives.pureftpd.org/archives.cgi?100:mss:3906:201103:cpeojfkblajnpinkeadd http://archives.pureftpd.org/archives.cgi?100:mss:3910:201103:cpeojfkblajnpinkeadd http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://lists.opensuse.org/opensuse-updates/2011-05/msg00029.html http://openwall.com/lists/oss-security/2011/04/11/14 http://openwall.com/lists/oss-security/2011/04/11/3 http://openwall.com/lists/oss-security/2011/04/11/7 http://openwall.com/lists& • CWE-399: Resource Management Errors •
CVSS: 4.0EPSS: 4%CPEs: 90EXPL: 3CVE-2011-0418 – FreeBSD 9.1 - 'ftpd' Remote Denial of Service
https://notcve.org/view.php?id=CVE-2011-0418
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command. La implementación del comando glob de Pure-FTPd en versiones anteriores a 1.0.32, y en libc de NetBSD 5.1, no expande apropiadamente las expresiones que contienen llaves, lo que permite a usuarios autenticados remotos provocar una denegación de servicio (consumo de toda la memoria) a través de un comando FTP STAT modificado. Multiple vendors are affected by a memory exhaustion vulnerability in libc/glob(3) GLOB_BRACE|GLOB_LIMIT. • https://www.exploit-db.com/exploits/24450 http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c#rev1.28 http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c.diff?r1=1.27&r2=1.28&f=h http://securityreason.com/achievement_securityalert/97 http://securityreason.com/securityalert/8228 http://www.mandriva.com/security/advisories?name=MDVSA-2011:094 http://www.pureftpd.org/project/pure-ftpd/news http://www.securityfocus.com/bid/47671 http://www.vupen.com • CWE-20: Improper Input Validation •