CVE-2012-6095: Race Condition
Published Jan 24, 2013
·Updated
ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.
Affected Software
68 affected components
ProFTPD ProFTPD<=1.3.4
ProFTPD ProFTPD=1.2.0
ProFTPD ProFTPD=1.2.0-pre10
ProFTPD ProFTPD=1.2.0-pre9
ProFTPD ProFTPD=1.2.0-rc1
ProFTPD ProFTPD=1.2.0-rc2
ProFTPD ProFTPD=1.2.0-rc3
ProFTPD ProFTPD=1.2.1
ProFTPD ProFTPD=1.2.2
ProFTPD ProFTPD=1.2.2-rc1
ProFTPD ProFTPD=1.2.2-rc2
ProFTPD ProFTPD=1.2.2-rc3
ProFTPD ProFTPD=1.2.3
ProFTPD ProFTPD=1.2.4
ProFTPD ProFTPD=1.2.5
ProFTPD ProFTPD=1.2.5-rc1
ProFTPD ProFTPD=1.2.5-rc2
ProFTPD ProFTPD=1.2.5-rc3
ProFTPD ProFTPD=1.2.6
ProFTPD ProFTPD=1.2.6-rc1
ProFTPD ProFTPD=1.2.6-rc2
ProFTPD ProFTPD=1.2.7
ProFTPD ProFTPD=1.2.7-rc1
ProFTPD ProFTPD=1.2.7-rc2
ProFTPD ProFTPD=1.2.7-rc3
ProFTPD ProFTPD=1.2.8
ProFTPD ProFTPD=1.2.8-rc1
ProFTPD ProFTPD=1.2.8-rc2
ProFTPD ProFTPD=1.2.9
ProFTPD ProFTPD=1.2.9-rc1
ProFTPD ProFTPD=1.2.9-rc2
ProFTPD ProFTPD=1.2.9-rc3
ProFTPD ProFTPD=1.2.10
ProFTPD ProFTPD=1.2.10-rc1
ProFTPD ProFTPD=1.2.10-rc2
ProFTPD ProFTPD=1.2.10-rc3
ProFTPD ProFTPD=1.3.0
ProFTPD ProFTPD=1.3.0-a
ProFTPD ProFTPD=1.3.0-rc1
ProFTPD ProFTPD=1.3.0-rc2
ProFTPD ProFTPD=1.3.0-rc3
ProFTPD ProFTPD=1.3.0-rc4
ProFTPD ProFTPD=1.3.0-rc5
ProFTPD ProFTPD=1.3.1
ProFTPD ProFTPD=1.3.1-rc1
ProFTPD ProFTPD=1.3.1-rc2
ProFTPD ProFTPD=1.3.1-rc3
ProFTPD ProFTPD=1.3.2
ProFTPD ProFTPD=1.3.2-a
ProFTPD ProFTPD=1.3.2-b
ProFTPD ProFTPD=1.3.2-c
ProFTPD ProFTPD=1.3.2-d
ProFTPD ProFTPD=1.3.2-e
ProFTPD ProFTPD=1.3.2-rc1
ProFTPD ProFTPD=1.3.2-rc2
ProFTPD ProFTPD=1.3.2-rc3
ProFTPD ProFTPD=1.3.2-rc4
ProFTPD ProFTPD=1.3.3
ProFTPD ProFTPD=1.3.3-a
ProFTPD ProFTPD=1.3.3-b
ProFTPD ProFTPD=1.3.3-c
ProFTPD ProFTPD=1.3.3-rc1
ProFTPD ProFTPD=1.3.3-rc2
ProFTPD ProFTPD=1.3.3-rc3
ProFTPD ProFTPD=1.3.3-rc4
ProFTPD ProFTPD=1.3.4-rc1
ProFTPD ProFTPD=1.3.4-rc2
ProFTPD ProFTPD=1.3.4-rc3
Event History
Jan 24, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-6095?
CVE-2012-6095 is classified as a moderate severity vulnerability that allows local users to exploit a race condition.
2
How do I fix CVE-2012-6095?
To fix CVE-2012-6095, upgrade ProFTPD to version 1.3.5rc1 or later.
3
Who is affected by CVE-2012-6095?
CVE-2012-6095 affects all versions of ProFTPD prior to 1.3.5rc1, especially those utilizing the UserOwner directive.
4
What type of attack does CVE-2012-6095 facilitate?
CVE-2012-6095 facilitates attacks via symlinks to manipulate file ownership by local users.
5
Can CVE-2012-6095 allow unauthorized access to root files?
Yes, CVE-2012-6095 may allow local users to gain unauthorized access to files by modifying their ownership.