CVE-2006-5778 - ftpd in linux-ftpd 0.17, and possibly other versions, performs a chdir before setting the UID, which

CVE-2006-5778

Summary

ftpd in linux-ftpd 0.17, and possibly other versions, performs a chdir before setting the UID, which allows local users to bypass intended access restrictions by redirecting their home directory to a restricted directory.

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454
http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/049014.html
http://secunia.com/advisories/22997
http://security.gentoo.org/glsa/glsa-200611-05.xml
http://www.debian.org/security/2006/dsa-1217
http://www.securityfocus.com/bid/21000

Vulnerable Configurations

cpe:2.3:a:linux-ftpd-ssl:linux-ftpd-ssl:0.17:*:*:*:*:*:*:*
cpe:2.3:a:linux-ftpd-ssl:linux-ftpd-ssl:0.17:*:*:*:*:*:*:*

CVSS

Base:	4.6 (as of 05-09-2008 - 21:13)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	21000
confirm	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384454
debian	DSA-1217
fulldisc	20060825 ftpd chdir() while root
gentoo	GLSA-200611-05
secunia	22997

Last major update

05-09-2008 - 21:13

Published

07-11-2006 - 18:07

Last modified

05-09-2008 - 21:13