Executive Summary
| Summary | |
|---|---|
| Title | lftp security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2010:0585 | First vendor Publication | 2010-08-02 |
| Vendor | RedHat | Last vendor Modification | 2010-08-02 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: An updated lftp package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: LFTP is a sophisticated file transfer program for the FTP and HTTP protocols. Like Bash, it has job control and uses the Readline library for input. It has bookmarks, built-in mirroring, and can transfer several files in parallel. It is designed with reliability in mind. It was discovered that lftp trusted the file name provided in the Content-Disposition HTTP header. A malicious HTTP server could use this flaw to write or overwrite files in the current working directory of a victim running lftp, by sending a different file from what the victim requested. (CVE-2010-2251) To correct this flaw, the following changes were made to lftp: the "xfer:clobber" option now defaults to "no", causing lftp to not overwrite existing files, and a new option, "xfer:auto-rename", which defaults to "no", has been introduced to control whether lftp should use server-suggested file names. Refer to the "Settings" section of the lftp(1) manual page for additional details on changing lftp settings. All lftp users should upgrade to this updated package, which contains a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 591580 - CVE-2010-2251 lftp: multiple HTTP client download filename vulnerability [OCERT 2010-001] |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2010-0585.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12796 | |||
| Oval ID: | oval:org.mitre.oval:def:12796 | ||
| Title: | DSA-2085-1 lftp -- missing input validation | ||
| Description: | It was discovered that in lftp, a command-line HTTP/FTP client, there is no proper validation of the filename provided by the server through the Content-Disposition header; attackers can use this flaw by suggesting a filename they wish to overwrite on the client machine, and then possibly execute arbitrary code. For the stable distribution, this problem has been fixed in version 3.7.3-1+lenny1. For the testing distribution, this problem has been fixed in version 4.0.6-1. For the unstable distribution, this problem has been fixed in version 4.0.6-1. We recommend that you upgrade your lftp packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2085-1 CVE-2010-2251 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | lftp |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:13484 | |||
| Oval ID: | oval:org.mitre.oval:def:13484 | ||
| Title: | USN-984-1 -- lftp vulnerability | ||
| Description: | It was discovered that LFTP incorrectly filtered filenames suggested by Content-Disposition headers. If a user or automated system were tricked into downloading a file from a malicious site, a remote attacker could create the file with an arbitrary name, such as a dotfile, and possibly run arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-984-1 CVE-2010-2251 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 10.04 Ubuntu 9.04 Ubuntu 9.10 | Product(s): | lftp |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22074 | |||
| Oval ID: | oval:org.mitre.oval:def:22074 | ||
| Title: | RHSA-2010:0585: lftp security update (Moderate) | ||
| Description: | The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2010:0585-01 CESA-2010:0585 CVE-2010-2251 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | lftp |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22803 | |||
| Oval ID: | oval:org.mitre.oval:def:22803 | ||
| Title: | ELSA-2010:0585: lftp security update (Moderate) | ||
| Description: | The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2010:0585-01 CVE-2010-2251 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | lftp |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:28103 | |||
| Oval ID: | oval:org.mitre.oval:def:28103 | ||
| Title: | DEPRECATED: ELSA-2010-0585 -- lftp security update (moderate) | ||
| Description: | [3.7.11-4.el5_5.3] - Related: CVE-2010-2251 - document change of xfer:clobber default value in manpage, respect xfer:clobber on with xfer:auto-rename on (old behaviour) [3.7.11-4.el5_5.2] - Related: CVE-2010-2251 - describe new option xfer:auto-rename which could restore old behaviour in manpage [3.7.11-4.el5_5.1] - Resolves: CVE-2010-2251 - multiple HTTP client download filename vulnerability (#617870) | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2010-0585 CVE-2010-2251 | Version: | 4 |
| Platform(s): | Oracle Linux 5 | Product(s): | lftp |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for lftp CESA-2010:0585 centos5 i386 File : nvt/gb_CESA-2010_0585_lftp_centos5_i386.nasl |
| 2010-10-10 | Name : FreeBSD Ports: lftp File : nvt/freebsd_lftp0.nasl |
| 2010-09-10 | Name : Ubuntu Update for lftp vulnerability USN-984-1 File : nvt/gb_ubuntu_USN_984_1.nasl |
| 2010-08-21 | Name : Debian Security Advisory DSA 2085-1 (lftp) File : nvt/deb_2085_1.nasl |
| 2010-08-06 | Name : RedHat Update for lftp RHSA-2010:0585-01 File : nvt/gb_RHSA-2010_0585-01_lftp.nasl |
| 2010-07-12 | Name : Mandriva Update for lftp MDVSA-2010:128 (lftp) File : nvt/gb_mandriva_MDVSA_2010_128.nasl |
| 2010-07-02 | Name : Fedora Update for lftp FEDORA-2010-9819 File : nvt/gb_fedora_2010_9819_lftp_fc12.nasl |
| 2010-04-29 | Name : Mandriva Update for epiphany MDVA-2010:128 (epiphany) File : nvt/gb_mandriva_MDVA_2010_128.nasl |
| 2010-04-29 | Name : Mandriva Update for epiphany MDVA-2010:128-1 (epiphany) File : nvt/gb_mandriva_MDVA_2010_128_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 64713 | LFTP lftpget get1 Command Content-Disposition Header Suggested Filename Arbit... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-08.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2010-0585.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20100802_lftp_for_SL_5.nasl - Type : ACT_GATHER_INFO |
| 2010-09-08 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-984-1.nasl - Type : ACT_GATHER_INFO |
| 2010-09-04 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_29b7e3f4b6a911dfae63f255a795cb21.nasl - Type : ACT_GATHER_INFO |
| 2010-08-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2085.nasl - Type : ACT_GATHER_INFO |
| 2010-08-03 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2010-0585.nasl - Type : ACT_GATHER_INFO |
| 2010-08-03 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0585.nasl - Type : ACT_GATHER_INFO |
| 2010-07-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-128.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-9819.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_lftp-100610.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_lftp-100610.nasl - Type : ACT_GATHER_INFO |
| 2010-06-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_lftp-100610.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:53:41 |
|
