CVE-2011-0988: Medium severity pure-ftpd vulnerability
pure-ftpd 1.0.22, as used in SUSE Linux Enterprise Server 10 SP3 and SP4, and Enterprise Desktop 10 SP3 and SP4, when running OES Netware extensions, creates a world-writeable directory, which allows local users to overwrite arbitrary files and gain privileges via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What versions of SUSE Linux are affected by CVE-2011-0988?
SUSE Linux Enterprise Server 10 SP3, 10 SP4, and SUSE Linux Enterprise Desktop 10 SP3, 10 SP4 are affected.
What software does CVE-2011-0988 specifically target?
CVE-2011-0988 specifically targets Pure-FTPd version 1.0.22.
What is the main security risk associated with CVE-2011-0988?
The vulnerability allows local users to overwrite arbitrary files, potentially gaining elevated privileges.
Is there a specific patch available for CVE-2011-0988?
Yes, applying the recommended updates from the SUSE repository mitigates the vulnerability.
What can be done to mitigate risks associated with CVE-2011-0988?
Restrict access to the world-writeable directory and ensure that users have the least privileges necessary.