Sign-up

ID

VAR-202002-1107


CVE

CVE-2020-9274


TITLE

Pure-FTPd Vulnerability in accessing uninitialized pointers in

Trust: 0.8

sources: JVNDB: JVNDB-2020-002394

DESCRIPTION

An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c. Pure-FTPd is an FTP (File Transfer Protocol) server. The 'init_aliases' function in the diraliases.c file in Pure-FTPd 1.0.49 has a security vulnerability. No detailed vulnerability details are provided at this time. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202003-54 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Pure-FTPd: Multiple vulnerabilities Date: March 25, 2020 Bugs: #711124 ID: 202003-54 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Pure-FTPd, the worst of which could allow remote attackers to cause a Denial of Service condition. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-ftp/pure-ftpd < 1.0.49-r2 >= 1.0.49-r2 Description =========== Multiple vulnerabilities have been discovered in Pure-FTPd. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could possibly cause a Denial of Service condition or cause an information disclosure. Workaround ========== There is no known workaround at this time. Resolution ========== All Pure-FTPd users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-ftp/pure-ftpd-1.0.49-r2" References ========== [ 1 ] CVE-2020-9274 https://nvd.nist.gov/vuln/detail/CVE-2020-9274 [ 2 ] CVE-2020-9365 https://nvd.nist.gov/vuln/detail/CVE-2020-9365 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202003-54 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. License ======= Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-4515-1 September 17, 2020 pure-ftpd vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Pure-FTPd could be made to expose sensitive information if it recieved specially crafted input. Software Description: - pure-ftpd: Secure and efficient FTP server Details: Antonio Norales discovered that Pure-FTPd incorrectly handled directory aliases. (CVE-2020-9274) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: pure-ftpd 1.0.36-3.2+deb8u1build0.16.04.1 pure-ftpd-common 1.0.36-3.2+deb8u1build0.16.04.1 pure-ftpd-ldap 1.0.36-3.2+deb8u1build0.16.04.1 pure-ftpd-mysql 1.0.36-3.2+deb8u1build0.16.04.1 pure-ftpd-postgresql 1.0.36-3.2+deb8u1build0.16.04.1 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/4515-1 CVE-2020-9274 Package Information: https://launchpad.net/ubuntu/+source/pure-ftpd/1.0.36-3.2+deb8u1build0.16.04.1

Trust: 2.34

sources: NVD: CVE-2020-9274 // JVNDB: JVNDB-2020-002394 // CNVD: CNVD-2020-15947 // PACKETSTORM: 156917 // PACKETSTORM: 159213

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-15947

AFFECTED PRODUCTS

vendor:fedoraprojectmodel:extra packages for enterprise linuxscope:eqversion:8.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:8.0

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:30

Trust: 1.0

vendor:pureftpdmodel:pure-ftpdscope:ltversion:1.0.50

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:32

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:31

Trust: 1.0

vendor:fedoraprojectmodel:extra packages for enterprise linuxscope:eqversion:7.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:16.04

Trust: 1.0

vendor:debianmodel:gnu/linuxscope: - version: -

Trust: 0.8

vendor:pureftpdmodel:pure-ftpdscope:eqversion:1.0.49

Trust: 0.8

vendor:pure ftpdmodel:pure-ftpdscope:eqversion:1.0.49

Trust: 0.6

sources: CNVD: CNVD-2020-15947 // JVNDB: JVNDB-2020-002394 // NVD: CVE-2020-9274

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-9274
value: HIGH

Trust: 1.0

NVD: JVNDB-2020-002394
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-15947
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202002-1237
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2020-9274
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-002394
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-15947
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2020-9274
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-002394
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-15947 // JVNDB: JVNDB-2020-002394 // CNNVD: CNNVD-202002-1237 // NVD: CVE-2020-9274

PROBLEMTYPE DATA

problemtype:CWE-824

Trust: 1.8

sources: JVNDB: JVNDB-2020-002394 // NVD: CVE-2020-9274

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 156917 // CNNVD: CNNVD-202002-1237

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202002-1237

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-002394

PATCH
title:[SECURITY] [DLA 2123-1] pure-ftpd security updateurl:https://lists.debian.org/debian-lts-announce/2020/02/msg00029.html
Trust: 0.8
title:diraliases: always set the tail of the list to NULLurl:https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
Trust: 0.8
title:Latest newsurl:https://www.pureftpd.org/project/pure-ftpd/news/
Trust: 0.8
title:Patch for Pure-FTPd Buffer Overflow Vulnerability (CNVD-2020-15947)url:https://www.cnvd.org.cn/patchInfo/show/207671
Trust: 0.6
title:Pure-FTPd Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=111222
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-15947 // 
            
            
            
            JVNDB: JVNDB-2020-002394 // 
            
            
            
            CNNVD: CNNVD-202002-1237

EXTERNAL IDS
db:NVDid:CVE-2020-9274
Trust: 3.2
db:JVNDBid:JVNDB-2020-002394
Trust: 0.8
db:PACKETSTORMid:156917
Trust: 0.7
db:PACKETSTORMid:159213
Trust: 0.7
db:CNVDid:CNVD-2020-15947
Trust: 0.6
db:AUSCERTid:ESB-2020.0745
Trust: 0.6
db:AUSCERTid:ESB-2020.3194
Trust: 0.6
db:CNNVDid:CNNVD-202002-1237
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-15947 // 
            
            
            
            JVNDB: JVNDB-2020-002394 // 
            
            
            
            PACKETSTORM: 156917 // 
            
            
            
            PACKETSTORM: 159213 // 
            
            
            
            CNNVD: CNNVD-202002-1237 // 
            
            
            
            NVD: CVE-2020-9274

REFERENCES
url:https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
Trust: 2.2
url:https://nvd.nist.gov/vuln/detail/cve-2020-9274
Trust: 2.2
url:https://security.gentoo.org/glsa/202003-54
Trust: 1.7
url:https://www.pureftpd.org/project/pure-ftpd/news/
Trust: 1.6
url:https://usn.ubuntu.com/4515-1/
Trust: 1.6
url:https://lists.debian.org/debian-lts-announce/2020/02/msg00029.html
Trust: 1.6
url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22p44peczwndp7cmbl7nrbmnfs73c5z2/
Trust: 1.0
url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/b5nsudwxzvwucl6r2ptx3kbb42z62ca5/
Trust: 1.0
url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/u5dbvhjcxwrsjpnjqcjqckzf6zdpzcka/
Trust: 1.0
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-9274
Trust: 0.8
url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/u5dbvhjcxwrsjpnjqcjqckzf6zdpzcka/
Trust: 0.6
url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/b5nsudwxzvwucl6r2ptx3kbb42z62ca5/
Trust: 0.6
url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22p44peczwndp7cmbl7nrbmnfs73c5z2/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.3194/
Trust: 0.6
url:https://vigilance.fr/vulnerability/pure-ftpd-out-of-bounds-memory-reading-via-init-aliases-31700
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.0745/
Trust: 0.6
url:https://packetstormsecurity.com/files/156917/gentoo-linux-security-advisory-202003-54.html
Trust: 0.6
url:https://packetstormsecurity.com/files/159213/ubuntu-security-notice-usn-4515-1.html
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2020-9365
Trust: 0.1
url:https://creativecommons.org/licenses/by-sa/2.5
Trust: 0.1
url:https://security.gentoo.org/
Trust: 0.1
url:https://bugs.gentoo.org.
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/pure-ftpd/1.0.36-3.2+deb8u1build0.16.04.1
Trust: 0.1
url:https://usn.ubuntu.com/4515-1
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2020-15947 // 
            
            
            
            JVNDB: JVNDB-2020-002394 // 
            
            
            
            PACKETSTORM: 156917 // 
            
            
            
            PACKETSTORM: 159213 // 
            
            
            
            CNNVD: CNNVD-202002-1237 // 
            
            
            
            NVD: CVE-2020-9274

CREDITS
Ubuntu,Gentoo
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202002-1237

SOURCES
db:CNVDid:CNVD-2020-15947
db:JVNDBid:JVNDB-2020-002394
db:PACKETSTORMid:156917
db:PACKETSTORMid:159213
db:CNNVDid:CNNVD-202002-1237
db:NVDid:CVE-2020-9274

LAST UPDATE DATE
2024-11-23T23:01:31.529000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-15947date:2020-03-07T00:00:00
db:JVNDBid:JVNDB-2020-002394date:2020-03-13T00:00:00
db:CNNVDid:CNNVD-202002-1237date:2020-09-23T00:00:00
db:NVDid:CVE-2020-9274date:2024-11-21T05:40:19.900

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-15947date:2020-03-07T00:00:00
db:JVNDBid:JVNDB-2020-002394date:2020-03-13T00:00:00
db:PACKETSTORMid:156917date:2020-03-26T14:45:34
db:PACKETSTORMid:159213date:2020-09-17T21:25:23
db:CNNVDid:CNNVD-202002-1237date:2020-02-26T00:00:00
db:NVDid:CVE-2020-9274date:2020-02-26T16:15:19.847