The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

Pure-ftpd is vulnerable to the STARTTLS command injection issue similar to CVE-2011-0411 of postfix. CVE-2011-1575 has been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-201110-25 (Pure-FTPd: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Pure-FTPd. Please       review the CVE identifiers referenced below for details.
  Impact :

    Remote unauthenticated attackers may be able to inject FTP commands or       cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Pure-FTPd development team reports :

Support for braces expansion in directory listings has been disabled
-- Cf. CVE-2011-0418.

Fix a STARTTLS flaw similar to Postfix's CVE-2011-0411. If you're using TLS, upgrading is recommended.

The remote FTP server contains a software flaw in its AUTH TLS implementation that could allow a remote, unauthenticated attacker to inject commands during the plaintext protocol phase that will be executed during the ciphertext protocol phase. 

Successful exploitation could permit an attacker to modify files on the FTP server and reveal a user's credentials.

ID	Name	Product	Family	Severity
76000	openSUSE Security Update : pure-ftpd (openSUSE-SU-2011:0483-1)	Nessus	SuSE Local Security Checks	medium
75716	openSUSE Security Update : pure-ftpd (openSUSE-SU-2011:0483-1)	Nessus	SuSE Local Security Checks	medium
57246	SuSE 10 Security Update : pure-ftpd (ZYPP Patch Number 7480)	Nessus	SuSE Local Security Checks	medium
56659	GLSA-201110-25 : Pure-FTPd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
54830	SuSE 10 Security Update : pure-ftpd (ZYPP Patch Number 7466)	Nessus	SuSE Local Security Checks	medium
54828	SuSE 11.1 Security Update : pure-ftpd (SAT Patch Number 4360)	Nessus	SuSE Local Security Checks	medium
54620	FreeBSD : pureftpd -- multiple vulnerabilities (1495f931-8522-11e0-a1c1-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	medium
53888	openSUSE Security Update : pure-ftpd (openSUSE-SU-2011:0483-1)	Nessus	SuSE Local Security Checks	medium
53847	FTP Service AUTH TLS Plaintext Command Injection	Nessus	FTP	medium

Detections

Analytics

CVE-2011-1575

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium