Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2004-0148 | First vendor Publication | 2004-04-15 |
| Vendor | Cve | Last vendor Modification | 2024-11-20 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0148 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:1147 | |||
| Oval ID: | oval:org.mitre.oval:def:1147 | ||
| Title: | HP-UX wuftpd Privilege Escalation Vulnerability (B.11.11) | ||
| Description: | wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0148 | Version: | 1 |
| Platform(s): | HP-UX 11 | Product(s): | ftpd |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1636 | |||
| Oval ID: | oval:org.mitre.oval:def:1636 | ||
| Title: | HP-UX wuftpd Privilege Escalation Vulnerability (B.11.22) | ||
| Description: | wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0148 | Version: | 4 |
| Platform(s): | HP-UX 11 | Product(s): | ftpd |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:1637 | |||
| Oval ID: | oval:org.mitre.oval:def:1637 | ||
| Title: | HP-UX wuftpd Privilege Escalation Vulnerability (B.11.00) | ||
| Description: | wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0148 | Version: | 1 |
| Platform(s): | HP-UX 11 | Product(s): | ftpd |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:648 | |||
| Oval ID: | oval:org.mitre.oval:def:648 | ||
| Title: | HP-UX wuftpd Privilege Escalation Vulnerability (B.11.23) | ||
| Description: | wu-ftpd 2.6.2 and earlier, with the restricted-gid option enabled, allows local users to bypass access restrictions by changing the permissions to prevent access to their home directory, which causes wu-ftpd to use the root directory instead. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0148 | Version: | 5 |
| Platform(s): | HP-UX 11 | Product(s): | ftpd |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-04 | Name : FreeBSD Ports: wu-ftpd File : nvt/freebsd_wu-ftpd0.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 457-1 (wu-ftpd) File : nvt/deb_457_1.nasl |
| 2005-11-03 | Name : wu-ftpd S/KEY authentication overflow File : nvt/wu_ftpd_skey_remote_buff.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 4160 | WU-FTPD restricted-gid Directory Access Restriction Bypass WU-FTPD contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when the restricted-gid feature is used. A malicious user can change the permissions on their home directory to deny themselves access. A subsequent connection by that user will exploit the flaw, and put them into the home directory of the root user, which will disclose files that an ordinary user would not have access to resulting in a loss of confidentiality. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-04-23 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3b7c7f6c710211d8873f0020ed76ef5a.nasl - Type : ACT_GATHER_INFO |
| 2007-09-25 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHNE_31732.nasl - Type : ACT_GATHER_INFO |
| 2005-03-18 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHNE_30983.nasl - Type : ACT_GATHER_INFO |
| 2005-02-16 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHNE_29462.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-457.nasl - Type : ACT_GATHER_INFO |
| 2004-08-25 | Name : The remote FTP server seems to be vulnerable to a remote buffer overflow. File : wu_ftpd_skey_remote_buff.nasl - Type : ACT_GATHER_INFO |
| 2004-07-06 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2004-096.nasl - Type : ACT_GATHER_INFO |
| 2004-03-14 | Name : The remote FTP server has an access restriction bypass vulnerability. File : wu_ftpd_restricted_gid_bypass.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:23:06 |
|
| 2024-11-28 12:06:00 |
|
| 2021-05-04 12:02:16 |
|
| 2021-04-22 01:02:25 |
|
| 2020-05-23 00:15:43 |
|
| 2018-05-03 09:19:25 |
|
| 2016-10-18 12:01:17 |
|
| 2016-04-26 12:47:09 |
|
| 2014-02-17 10:27:12 |
|
| 2013-05-11 11:39:56 |
|
