CVE-2011-1526

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which…

published July 11, 2011

CVSS
—
EPSS
4%
Percentile
90.3
In the wild
Unconfirmed
What it is

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03938 · 90.3th percentile
Published
2011-07-11T20:00Z
EPSS history
Timeline
  • 11 JUL 20:00Z
    ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which…
    cvelistv5