CVE-2004-0432

ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://bugs.proftpd.org/show_bug.cgi?id=2267
http://marc.info/?l=bugtraq&m=108335030208523&w=2
http://marc.info/?l=bugtraq&m=108335051011341&w=2
http://secunia.com/advisories/11527
http://www.mandriva.com/security/advisories?name=MDKSA-2004:041
http://www.securityfocus.com/bid/10252	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16038

Configurations

Configuration 1 (hide)

cpe:2.3:a:proftpd_project:proftpd:1.2.9:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:gentoo:linux:0.5:::::::*
	cpe:2.3:o:gentoo:linux:0.7:::::::*
	cpe:2.3:o:gentoo:linux:1.1a:::::::*
	cpe:2.3:o:gentoo:linux:1.2:::::::*
	cpe:2.3:o:gentoo:linux:1.4:::::::*
	cpe:2.3:o:gentoo:linux:1.4:rc1::::::
	cpe:2.3:o:gentoo:linux:1.4:rc2::::::
	cpe:2.3:o:gentoo:linux:1.4:rc3::::::
	cpe:2.3:o:trustix:secure_linux:2.0:::::::*
	cpe:2.3:o:trustix:secure_linux:2.1:::::::*

History

No history.

Information

Published : 2004-08-18 04:00

Updated : 2017-07-11 01:30

NVD link : CVE-2004-0432

Mitre link : CVE-2004-0432

CVE.ORG link : CVE-2004-0432

JSON object : View

Products Affected

trustix

secure_linux

gentoo

linux

proftpd_project

proftpd

CWE

NVD-CWE-Other

{"id": "CVE-2004-0432", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2004-08-18T04:00:00.000", "references": [{"url": "http://bugs.proftpd.org/show_bug.cgi?id=2267", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=108335030208523&w=2", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=bugtraq&m=108335051011341&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/11527", "source": "cve@mitre.org"}, {"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2004:041", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/10252", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16038", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions."}, {"lang": "es", "value": "ProFTPD 1.2.9 trata las directivas Permitir y Denegar para ACLS basadas en CIDR como si fueran AllowAll (Permitir Todo), lo que podr\u00eda permitir a clientes FTP saltarse las restricciones de acceso pretendidas."}], "lastModified": "2017-07-11T01:30:09.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:proftpd_project:proftpd:1.2.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2C1A60B-D79B-4EE3-9E48-83AF875AD062"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:gentoo:linux:0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "980553F2-8662-47CF-95F0-645141746AEA"}, {"criteria": "cpe:2.3:o:gentoo:linux:0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40EBF1CD-B392-4262-8F06-2C784ADAF0F0"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.1a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C00F84A-FCD4-4935-B7DE-ECBA6AE9B074"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "960DC6C2-B285-41D4-96F7-ED97F8BD5482"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65ED9D8C-604D-4B0B-A192-C0DA4D2E9AEB"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1FD0EB4-E744-4465-AFEE-A3C807C9C993"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D866A7D-F0B9-4EA3-93C6-1E7C2C2A861F"}, {"criteria": "cpe:2.3:o:gentoo:linux:1.4:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57772E3B-893C-408A-AA3B-78C972ED4D5E"}, {"criteria": "cpe:2.3:o:trustix:secure_linux:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53AF1A2D-B0A2-4097-AD1D-DF3AF27171BA"}, {"criteria": "cpe:2.3:o:trustix:secure_linux:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A67735E5-E43E-4164-BDB2-ADC6E0288E9F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}