Advisories » MGASA-2017-0115

Updated proftpd packages fix security vulnerability

Publication date: 24 Apr 2017
Modification date: 24 Apr 2017
Type: security
Affected Mageia releases : 5
CVE: CVE-2017-7418

Description

ProFTPD before 1.3.5e controls whether the home directory of a user could
contain a symbolic link through the AllowChrootSymlinks configuration
option, but checks only the last path component when enforcing
AllowChrootSymlinks. Attackers with local access could bypass the
AllowChrootSymlinks control by replacing a path component (other than the
last one) with a symbolic link. The threat model includes an attacker who
is not granted full filesystem access by a hosting provider, but can
reconfigure the home directory of an FTP user (CVE-2017-7418).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=20640
• http://www.proftpd.org/docs/RELEASE_NOTES-1.3.5e
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7418

SRPMS

5/core

• proftpd-1.3.5e-1.mga5