Gentoo FoundationGLSA-201611-05tnftp: Arbitrary code execution
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.959 High
EPSS
Percentile
99.5%
Background
tnftp is a NetBSD FTP client with several advanced features.
Description
The fetch_url function in usr.bin/ftp/fetch.c allows remote attackers to execute arbitrary commands via a
Impact
A remote attacker could possibly execute arbitrary code with the privileges of the process.
Workaround
There is no known workaround at this time.
Resolution
All tnftp users should upgrade to the latest version:
# emerge --sync
# emerge --ask --verbose --oneshot ">=net-ftp/tnftp-20141104"
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Gentoo | any | all | net-ftp/tnftp | < 20141104 | UNKNOWN |
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.959 High
EPSS
Percentile
99.5%