CVE-2011-1526
First published: Tue Jun 07 2011(Updated: )
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MIT krb5-appl | <1.0.1 | |
| Debian Debian Linux | =5.0 | |
| Debian Debian Linux | =6.0 | |
| Fedoraproject Fedora | =15 | |
| Fedoraproject Fedora | =14 | |
| SUSE Linux Enterprise Desktop | =11-sp1 | |
| openSUSE openSUSE | =11.4 | |
| openSUSE openSUSE | =11.3 | |
| SUSE Linux Enterprise Server | =10-sp2 | |
| SUSE Linux Enterprise Software Development Kit | =10-sp4 | |
| SUSE Linux Enterprise Server | =11-sp1 | |
| SUSE Linux Enterprise Server | =10-sp3 | |
| SUSE Linux Enterprise Desktop | =10-sp4 | |
| SUSE Linux Enterprise Server | =10-sp4 | |
| SUSE Linux Enterprise Software Development Kit | =11-sp1 | |
| Suse Linux Enterprise Server | =11-sp1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1526
- http://web.mit.edu/kerberos/advisories/2011-005-patch.txt
- https://rhn.redhat.com/errata/RHSA-2011-0920.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=719095
- https://rhn.redhat.com/errata/RHSA-2012-0306.html
- https://bugzilla.redhat.com/show_bug.cgi?id=711419
- http://www.securityfocus.com/bid/48571
- http://secunia.com/advisories/45145
- http://secunia.com/advisories/45157
- http://www.redhat.com/support/errata/RHSA-2011-0920.html
- http://www.osvdb.org/73617
- http://www.debian.org/security/2011/dsa-2283
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html
- http://securityreason.com/securityalert/8301
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:117
- http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68398
- http://secunia.com/advisories/48101
- http://www.securityfocus.com/archive/1/518733/100/0/threaded
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1526
- vendor/mit
- canonical/mit krb5-appl
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/5.0
- version/debian debian linux/6.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/15
- version/fedoraproject fedora/14
- vendor/suse
- canonical/suse linux enterprise desktop
- version/suse linux enterprise desktop/11-sp1
- vendor/opensuse
- canonical/opensuse opensuse
- version/opensuse opensuse/11.4
- version/opensuse opensuse/11.3
- canonical/suse linux enterprise server
- version/suse linux enterprise server/10-sp2
- canonical/suse linux enterprise software development kit
- version/suse linux enterprise software development kit/10-sp4
- version/suse linux enterprise server/11-sp1
- version/suse linux enterprise server/10-sp3
- version/suse linux enterprise desktop/10-sp4
- version/suse linux enterprise server/10-sp4
- version/suse linux enterprise software development kit/11-sp1