Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

Unknown

Privileges Required

Unknown

Attack Vector

Unknown

0

CVE-2011-1526

Disclosure Date: July 11, 2011 •

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

None

Impact Score:

Unknown

Exploitability Score:

Unknown

Vector:

Attack Vector (AV):

Unknown

Attack Complexity (AC):

Unknown

Privileges Required (PR):

Unknown

User Interaction (UI):

Unknown

Scope (S):

Unknown

Confidentiality (C):

Unknown

Integrity (I):

Unknown

Availability (A):

Unknown

Vendors

debian,
fedoraproject,
mit,
opensuse,
suse

Products

debian linux 5.0,
debian linux 6.0,
fedora 14,
fedora 15,
krb5-appl,
linux enterprise desktop 10,
linux enterprise desktop 11,
linux enterprise server 10,
linux enterprise server 11,
linux enterprise software development kit 10,
linux enterprise software development kit 11,
opensuse 11.3,
opensuse 11.4

References

Canonical

CVE-2011-1526 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1526)

BID-48571 (http://www.securityfocus.com/bid/48571)

Advisory

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html

http://www.redhat.com/support/errata/RHSA-2011-0920.html

SECUNIA-48101 (http://secunia.com/advisories/48101)

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt

http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html

XF-kerberos-krb5appl-priv-esc(68398) (https://exchange.xforce.ibmcloud.com/vulnerabilities/68398)

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html

SECUNIA-45145 (http://secunia.com/advisories/45145)

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html

https://bugzilla.redhat.com/show_bug.cgi?id=711419

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html

SECUNIA-45157 (http://secunia.com/advisories/45157)

SREASON-8301 (http://securityreason.com/securityalert/8301)

http://www.mandriva.com/security/advisories?name=MDVSA-2011:117

FEDORA-2011-9109 (http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html)

OSVDB-73617 (http://www.osvdb.org/73617)

DSA-2283 (http://www.debian.org/security/2011/dsa-2283)

20110705 MITKRB5-SA-2011-005 FTP daemon fails to set effective group ID [CVE-2011-1526] (http://www.securityfocus.com/archive/1/518733/100/0/threaded)

FEDORA-2011-9080 (http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html)

Rapid7

Technical Analysis