Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2011-1526

krb5-appl: ftpd incorrect group privilege dropping (MITKRB5-SA-2011-005)

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.

CVSS 2.0 · 6.5 Medium EPSS 3.9% KEV · Not listed
Vendors
Debian Fedoraproject Mit and 3 more
Products
Debian Linux Fedora Krb5-appl and 5 more
CVE-2011-4862

krb5: telnet client and server encrypt_keyid heap-based buffer overflow

Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.

CVSS 2.0 · 10.0 Critical EPSS 95.1% KEV · Not listed
Vendors
Debian Fedoraproject Freebsd and 6 more
Products
Debian Linux Fedora Freebsd and 11 more
CVE-2019-25018

krb5-appl: Improper directory name validation allows malicious server to bypass access restrictions

In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Mit
Products
Krb5-appl
CVE-2019-25017

krb5-appl: Improper validation of object names allows malicious server to overwrite files via rcp client

An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

CVSS 3.1 · 5.9 Medium EPSS 1.4% KEV · Not listed
Vendors
Mit
Products
Krb5-appl