CVE-2020-7468
FreeBSD FTPD Improper Handling of Exceptional Conditions Privilege Escalation Vulnerability
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
In FreeBSD 12.2-STABLE before r365772, 11.4-STABLE before r365773, 12.1-RELEASE before p10, 11.4-RELEASE before p4 and 11.3-RELEASE before p14 a ftpd(8) bug in the implementation of the file system sandbox, combined with capabilities available to an authenticated FTP user, can be used to escape the file system restriction configured in ftpchroot(5). Moreover, the bug allows a malicious client to gain root privileges.
En FreeBSD versiones 12.2-STABLE anteriores a r365772, 11.4-STABLE anteriores a r365773, 12.1-RELEASE anteriores a p10, 11.4-RELEASE anteriores a p4 y 11.3-RELEASE anteriores a p14, un bug de ftpd(8) en la implementación del sandbox del sistema de archivos, combinado con las capacidades disponibles para un usuario FTP autenticado, puede ser usada para escapar de la restricción del sistema de archivos configurada en ftpchroot(5). Además, el bug permite a un cliente malicioso alcanzar privilegios root.
This vulnerability allows remote attackers to escalate privileges on affected installations of FreeBSD FTPD. Authentication is required to exploit this vulnerability.
The specific flaw exists within the enforcement of permissions. The process does not properly handle exceptional conditions. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of root.
*Credits:
Anonymous
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-01-21 CVE Reserved
- 2020-12-15 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://security.FreeBSD.org/advisories/FreeBSD-SA-20:30.ftpd.asc | 2022-07-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | - |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p1 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p10 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p11 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p12 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p13 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p2 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p3 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p4 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p5 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p6 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p7 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p8 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.3 Search vendor "Freebsd" for product "Freebsd" and version "11.3" | p9 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.4 Search vendor "Freebsd" for product "Freebsd" and version "11.4" | - |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.4 Search vendor "Freebsd" for product "Freebsd" and version "11.4" | p1 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.4 Search vendor "Freebsd" for product "Freebsd" and version "11.4" | p2 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 11.4 Search vendor "Freebsd" for product "Freebsd" and version "11.4" | p3 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | - |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p1 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p2 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p3 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p4 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p5 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p6 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p7 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p8 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.1 Search vendor "Freebsd" for product "Freebsd" and version "12.1" | p9 |
Affected
| ||||||
| Freebsd Search vendor "Freebsd" | Freebsd Search vendor "Freebsd" for product "Freebsd" | 12.2 Search vendor "Freebsd" for product "Freebsd" and version "12.2" | - |
Affected
| ||||||