Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious     'fzsftp' binary in the user's home directory. (CVE-2019-5429)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-3026 advisory.

    Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious     fzsftp binary in the user's home directory. For Debian 9 stretch, this problem has been fixed in version     3.24.0-1+deb9u1. We recommend that you upgrade your filezilla packages. For the detailed security status     of filezilla please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/filezilla Further information about Debian LTS security advisories, how to     apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202007-51 (FileZilla: Untrusted search path)

    It was discovered that FileZilla uses an untrusted search path.
  Impact :

    An attacker could use a malicious binary to escalate privileges.
  Workaround :

    There is no known workaround at this time.

Fix for CVE-2019-5429

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257159	Linux Distros Unpatched Vulnerability : CVE-2019-5429	Nessus	Misc.	high
161612	Debian DLA-3026-1 : filezilla - LTS security update	Nessus	Debian Local Security Checks	high
138974	GLSA-202007-51 : FileZilla: Untrusted search path	Nessus	Gentoo Local Security Checks	high
124702	Fedora 28 : filezilla / libfilezilla (2019-d109db9c8a)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-5429

high

Tenable Plugins

high

high

high

high