| Package | Affected versions | Patched versions |
|---|---|---|
| pure-ftpd | = 0.90= 0.91= 0.92= 0.93= 0.94= 0.95= 0.95-pre1= 0.95-pre2= 0.95-pre3= 0.95-pre4= 0.95.1= 0.95.2= 0.96= 0.96.1= 0.96pre1= 0.97-final= 0.97.1= 0.97.2= 0.97.3= 0.97.4= 0.97.5= 0.97.6= 0.97.7= 0.97.7pre1= 0.97.7pre2= 0.97.7pre3= 0.97pre1= 0.97pre2= 0.97pre3= 0.97pre4= 0.97pre5= 0.98-final= 0.98.1= 0.98.2= 0.98.2a= 0.98.3= 0.98.4= 0.98.5= 0.98.6= 0.98.7= 0.98pre1= 0.98pre2= 0.99= 0.99.1= 0.99.1a= 0.99.1b= 0.99.2= 0.99.2a= 0.99.3= 0.99.4= 0.99.9= 0.99a= 0.99b= 0.99pre1= 0.99pre2= 1.0.0= 1.0.1= 1.0.10= 1.0.11= 1.0.12= 1.0.13a= 1.0.14= 1.0.15= 1.0.16a= 1.0.16b= 1.0.16c= 1.0.17= 1.0.17a= 1.0.18= 1.0.19= 1.0.2= 1.0.20= 1.0.21= 1.0.22= 1.0.24= 1.0.25= 1.0.26= 1.0.27= 1.0.28= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.8= 1.0.9≤ 1.0.29 |
The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free