The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Critical CVSS 10.0 Listed in CISA KEV
Summary
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- ProFTPD:ProFTPD
- :
- :
- :
Sources
- NVD DATABASE
- CISA KEV DATABASE
Original Links
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
- http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
- http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html
- http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html
- http://www.debian.org/security/2015/dsa-3263
- http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
- http://www.securityfocus.com/bid/74238
- https://www.exploit-db.com/exploits/36742/ Exploit
- https://www.exploit-db.com/exploits/36803/ Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3306
- http://www.proftpd.org/ reference
- https://lists.debian.org/debian-security-announce/2015/msg00154.html reference
- https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ reference
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2015-3306 reference
Timeline
- nvd_ingest NVD
- kev_ingest CISA KEV