CVE-2011-3171: Path Traversal

Q: What is the severity of CVE-2011-3171?

CVE-2011-3171 is considered a high-severity vulnerability due to its potential for local users to overwrite arbitrary files.

Q: How do I fix CVE-2011-3171?

To fix CVE-2011-3171, update pure-FTPd to a version later than 1.0.22 that does not contain this vulnerability.

Q: Which versions of pure-FTPd are affected by CVE-2011-3171?

CVE-2011-3171 affects pure-FTPd versions up to and including 1.0.22.

Q: On which operating systems does CVE-2011-3171 occur?

CVE-2011-3171 occurs on SUSE Linux Enterprise Server and possibly other operating systems with the Netware OES remote server feature enabled.

Q: Can local users exploit CVE-2011-3171?

Yes, local users can exploit CVE-2011-3171 to overwrite arbitrary files due to the directory traversal vulnerability.

Published Nov 4, 2011

Updated

Directory traversal vulnerability in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating systems, when the Netware OES remote server feature is enabled, allows local users to overwrite arbitrary files via unknown vectors.

Affected Software

87 affected components

pureftpd Pure-FTPd<=1.0.22

pureftpd Pure-FTPd=0.90

pureftpd Pure-FTPd=0.91

pureftpd Pure-FTPd=0.92

pureftpd Pure-FTPd=0.93

pureftpd Pure-FTPd=0.94

pureftpd Pure-FTPd=0.95

pureftpd Pure-FTPd=0.95-pre1

pureftpd Pure-FTPd=0.95-pre2

pureftpd Pure-FTPd=0.95-pre3

pureftpd Pure-FTPd=0.95-pre4

pureftpd Pure-FTPd=0.95.1

pureftpd Pure-FTPd=0.95.2

pureftpd Pure-FTPd=0.96

pureftpd Pure-FTPd=0.96-pre1

pureftpd Pure-FTPd=0.96.1

pureftpd Pure-FTPd=0.97-pre1

pureftpd Pure-FTPd=0.97-pre2

pureftpd Pure-FTPd=0.97-pre3

pureftpd Pure-FTPd=0.97-pre4

pureftpd Pure-FTPd=0.97-pre5

pureftpd Pure-FTPd=0.97-final

pureftpd Pure-FTPd=0.97.1

pureftpd Pure-FTPd=0.97.2

pureftpd Pure-FTPd=0.97.3

pureftpd Pure-FTPd=0.97.4

pureftpd Pure-FTPd=0.97.5

pureftpd Pure-FTPd=0.97.6

pureftpd Pure-FTPd=0.97.7

pureftpd Pure-FTPd=0.97.7-pre1

pureftpd Pure-FTPd=0.97.7-pre2

pureftpd Pure-FTPd=0.97.7-pre3

pureftpd Pure-FTPd=0.98-final

pureftpd Pure-FTPd=0.98-pre1

pureftpd Pure-FTPd=0.98-pre2

pureftpd Pure-FTPd=0.98.1

pureftpd Pure-FTPd=0.98.2

pureftpd Pure-FTPd=0.98.2-a

pureftpd Pure-FTPd=0.98.3

pureftpd Pure-FTPd=0.98.4

pureftpd Pure-FTPd=0.98.5

pureftpd Pure-FTPd=0.98.6

pureftpd Pure-FTPd=0.98.7

pureftpd Pure-FTPd=0.99

pureftpd Pure-FTPd=0.99-a

pureftpd Pure-FTPd=0.99-b

pureftpd Pure-FTPd=0.99-pre1

pureftpd Pure-FTPd=0.99-pre2

pureftpd Pure-FTPd=0.99.1

pureftpd Pure-FTPd=0.99.1-a

pureftpd Pure-FTPd=0.99.1-b

pureftpd Pure-FTPd=0.99.2

pureftpd Pure-FTPd=0.99.2-a

pureftpd Pure-FTPd=0.99.3

pureftpd Pure-FTPd=0.99.4

pureftpd Pure-FTPd=0.99.9

pureftpd Pure-FTPd=1.0.0

pureftpd Pure-FTPd=1.0.1

pureftpd Pure-FTPd=1.0.2

pureftpd Pure-FTPd=1.0.3

pureftpd Pure-FTPd=1.0.4

pureftpd Pure-FTPd=1.0.5

pureftpd Pure-FTPd=1.0.6

pureftpd Pure-FTPd=1.0.7

pureftpd Pure-FTPd=1.0.8

pureftpd Pure-FTPd=1.0.9

pureftpd Pure-FTPd=1.0.10

pureftpd Pure-FTPd=1.0.11

pureftpd Pure-FTPd=1.0.12

pureftpd Pure-FTPd=1.0.13-a

pureftpd Pure-FTPd=1.0.14

pureftpd Pure-FTPd=1.0.15

pureftpd Pure-FTPd=1.0.16-a

pureftpd Pure-FTPd=1.0.16-b

pureftpd Pure-FTPd=1.0.16-c

pureftpd Pure-FTPd=1.0.17

pureftpd Pure-FTPd=1.0.17-a

pureftpd Pure-FTPd=1.0.18

pureftpd Pure-FTPd=1.0.19

pureftpd Pure-FTPd=1.0.20

pureftpd Pure-FTPd=1.0.21

SUSE Linux Enterprise Desktop=10-sp4

SUSE Linux Enterprise Desktop=11-sp1

SUSE Linux Enterprise Server=10-sp3

SUSE Linux Enterprise Server=10-sp4

SUSE Linux Enterprise Server=11-sp1

Event History

Nov 4, 2011

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

09:55 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2011-3171?

CVE-2011-3171 is considered a high-severity vulnerability due to its potential for local users to overwrite arbitrary files.

How do I fix CVE-2011-3171?

To fix CVE-2011-3171, update pure-FTPd to a version later than 1.0.22 that does not contain this vulnerability.

Which versions of pure-FTPd are affected by CVE-2011-3171?

CVE-2011-3171 affects pure-FTPd versions up to and including 1.0.22.

On which operating systems does CVE-2011-3171 occur?

CVE-2011-3171 occurs on SUSE Linux Enterprise Server and possibly other operating systems with the Netware OES remote server feature enabled.

Can local users exploit CVE-2011-3171?