Unscored severity · published May 23, 2011
CVE-2011-1575
The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into…
–
CVSS
33.3%
EPSS
No
On KEV
Description
The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Exploitation
Is it being used?
Exploit prediction (EPSS)33.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Pure-ftpd · Pureftpd
through 1.0.29; 0.90; 0.91; 0.92; 0.93; 0.94; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1575
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1575
archives.pureftpd.org
http://archives.pureftpd.org/archives.cgi?100:mss:3906:201103:cpeojfkblajnpinkeadd
Patch
http://archives.pureftpd.org/archives.cgi?100:mss:3910:201103:cpeojfkblajnpinkeadd
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2011-05/msg00029.html
openwall.com
http://openwall.com/lists/oss-security/2011/04/11/14
openwall.com
http://openwall.com/lists/oss-security/2011/04/11/3
More from Pure-ftpd
9.8
CVE-2017-12170
Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configuration was ignored after update and service…
8.6
CVE-2024-48208
pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow
7.5
CVE-2021-40524
In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a…
7.5
CVE-2020-35359
Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit
7.5
CVE-2020-9274
An issue was discovered in Pure-FTPd 1.0.49