Critical · published May 18, 2015
CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
⚠️ A crafty use of the site cpfr and site cpto commands can let attackers read and write to any file on your ProFTPD server! 😱 Think of it like a restaurant where a diner can secretly change the ingredients of any dish on the menu without anyone noticing — they could be adding allergens or swapping flavors entirely! 🍽️ This sneaky exploit could lead to unauthorized access, allowing attackers to modify or steal critical data from your system. Imagine the chaos if someone were to change your secret recipes or even worse, delete essential files!
Think of it like a restaurant where a diner can secretly change the ingredients of any dish on the menu without anyone noticing — they could be adding allergens or swapping flavors entirely! 🍽️ The mod_copy module in ProFTPD 1.3.5 allows attackers to leverage the powerful site cpfr and site cpto commands, enabling them to read and write arbitrary files without proper authorization.
This sneaky exploit could lead to unauthorized access, allowing attackers to modify or steal critical data from your system. Imagine the chaos if someone were to change your secret recipes or even worse, delete essential files! Upgrade your ProFTPD to version 1.3.6 or later to close this loophole. It's also wise to review your server configurations and restrict these commands where possible. Don't forget to monitor your server logs for any unusual activities! You can tackle this! With a few updates and checks, you’ll keep your server secure and running smoothly. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| opensuse/tumbleweed | all versions | — |
| suse/linux_enterprise_server | all versions | — |
| suse/linux_enterprise_server | all versions | — |
| proftpd/proftpd | all versions | — |