CVE - CVE-2017-7418

CVE-ID
CVE-2017-7418	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks control by replacing a path component (other than the last one) with a symbolic link. The threat model includes an attacker who is not granted full filesystem access by a hosting provider, but can reconfigure the home directory of an FTP user.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:97409 URL:http://www.securityfocus.com/bid/97409 CONFIRM:http://bugs.proftpd.org/show_bug.cgi?id=4295 CONFIRM:https://github.com/proftpd/proftpd/commit/ecff21e0d0e84f35c299ef91d7fda088e516d4ed CONFIRM:https://github.com/proftpd/proftpd/commit/f59593e6ff730b832dbe8754916cb5c821db579f CONFIRM:https://github.com/proftpd/proftpd/pull/444/commits/349addc3be4fcdad9bd4ec01ad1ccd916c898ed8 SUSE:openSUSE-SU-2019:1836 URL:http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00004.html SUSE:openSUSE-SU-2019:1870 URL:http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00022.html SUSE:openSUSE-SU-2020:0031 URL:http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html
Assigning CNA
MITRE Corporation
Date Record Created
20170404	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20170404)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)