Advisories ยป MGASA-2017-0115

Updated proftpd packages fix security vulnerability

Publication date: 24 Apr 2017
Type: security
Affected Mageia releases : 5
CVE: CVE-2017-7418


ProFTPD before 1.3.5e controls whether the home directory of a user could
contain a symbolic link through the AllowChrootSymlinks configuration
option, but checks only the last path component when enforcing
AllowChrootSymlinks. Attackers with local access could bypass the
AllowChrootSymlinks control by replacing a path component (other than the
last one) with a symbolic link. The threat model includes an attacker who
is not granted full filesystem access by a hosting provider, but can
reconfigure the home directory of an FTP user (CVE-2017-7418).