diff options
| author | mm <mm@FreeBSD.org> | 2017-07-27 17:53:52 +0800 |
|---|---|---|
| committer | mm <mm@FreeBSD.org> | 2017-07-27 17:53:52 +0800 |
| commit | f1989b159634e15b41a532e2d7db1fb68b65514c (patch) | |
| tree | 872e2118224c8e518d11ba48ecebcaf2920421da /security | |
| parent | 80795d3a6a3191d4d886789242e851033f134360 (diff) | |
| download | freebsd-ports-gnome-f1989b159634e15b41a532e2d7db1fb68b65514c.tar.gz freebsd-ports-gnome-f1989b159634e15b41a532e2d7db1fb68b65514c.tar.zst freebsd-ports-gnome-f1989b159634e15b41a532e2d7db1fb68b65514c.zip | |
security/vuxml: Add proftpd chroot secape vulnerability
Security: CVE-2017-7418
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 424a20a4f1b2..62bbd348875b 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,37 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="770d7e91-72af-11e7-998a-08606e47f965"> + <topic>proftpd -- user chroot escape vulnerability</topic> + <affects> + <package> + <name>proftpd</name> + <range><lt>1.3.5e</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>NVD reports:</p> + <blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2017-7418"> + <p>ProFTPD ... controls whether the home directory of a user could + contain a symbolic link through the AllowChrootSymlinks + configuration option, but checks only the last path component when + enforcing AllowChrootSymlinks. Attackers with local access could + bypass the AllowChrootSymlinks control by replacing a path + component (other than the last one) with a symbolic link.</p> + </blockquote> + </body> + </description> + <references> + <url>http://bugs.proftpd.org/show_bug.cgi?id=4295</url> + <cvename>CVE-2017-7418</cvename> + </references> + <dates> + <discovery>2017-03-06</discovery> + <entry>2017-07-27</entry> + </dates> + </vuln> + <vuln vid="76d80b33-7211-11e7-998a-08606e47f965"> <topic>jabberd -- authentication bypass vulnerability</topic> <affects> |