National Cyber Awareness System

Vulnerability Summary for CVE-2010-2251

Overview

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=602836

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=602836

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=591580

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=591580

External Source: VUPEN

Name: ADV-2010-1654

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/1654

External Source: BUGTRAQ

Name: 20101027 rPSA-2010-0073-1 lftp

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/514499/100/0/threaded

External Source: MISC

Name: http://www.ocert.org/advisories/ocert-2010-001.html

Hyperlink:http://www.ocert.org/advisories/ocert-2010-001.html

External Source: DEBIAN

Name: DSA-2085

Hyperlink:http://www.debian.org/security/2010/dsa-2085

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2010-0073

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2010-0073

External Source: SECUNIA

Name: 40400

Hyperlink:http://secunia.com/advisories/40400

External Source: MLIST

Name: [oss-security] 20100610 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability

Hyperlink:http://marc.info/?l=oss-security&m=127620248914170&w=2

External Source: MLIST

Name: [oss-security] 20100609 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability

Hyperlink:http://marc.info/?l=oss-security&m=127611288927500&w=2

External Source: MLIST

Name: [oss-security] 20100520 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability

Hyperlink:http://marc.info/?l=oss-security&m=127432968701342&w=2

External Source: MLIST

Name: [oss-security] 20100517 [oCERT-2010-001] multiple http client unexpected download filename vulnerability

Hyperlink:http://marc.info/?l=oss-security&m=127411372529485&w=2

External Source: SUSE

Name: SUSE-SR:2010:014

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html

External Source: FEDORA

Name: FEDORA-2010-9819

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043597.html

External Source: CONFIRM

Name: http://lftp.yar.ru/news.html

Hyperlink:http://lftp.yar.ru/news.html