Vulnerability CVE-2010-2251 - CERT Civis.Net

Vulnerability Name:

CVE-2010-2251 (CCN-58692)

Assigned:

2010-05-17

Published:

2010-05-17

Updated:

2018-10-10

Summary:

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
4.3 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2010-2251

Source: CCN
Type: LFTP Web site
LFTP

Source: CONFIRM
Type: UNKNOWN
http://lftp.yar.ru/news.html

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-9819

Source: SUSE
Type: UNKNOWN
SUSE-SR:2010:014

Source: MLIST
Type: UNKNOWN
[oss-security] 20100517 [oCERT-2010-001] multiple http client unexpected download filename vulnerability

Source: MLIST
Type: UNKNOWN
[oss-security] 20100520 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability

Source: MLIST
Type: UNKNOWN
[oss-security] 20100609 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability

Source: MLIST
Type: UNKNOWN
[oss-security] 20100610 Re: [oCERT-2010-001] multiple http client unexpected download filename vulnerability

Source: CCN
Type: RHSA-2010-0585
Moderate: lftp security update

Source: CCN
Type: SA39861
LFTP Insecure Content-Disposition Suggested Filename Handling Weakness

Source: SECUNIA
Type: UNKNOWN
40400

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/Advisories:rPSA-2010-0073

Source: DEBIAN
Type: UNKNOWN
DSA-2085

Source: DEBIAN
Type: DSA-2085
lftp -- missing input validation

Source: CCN
Type: ocert-2010-001
multiple http client unexpected download filename

Source: MISC
Type: UNKNOWN
http://www.ocert.org/advisories/ocert-2010-001.html

Source: CCN
Type: OSVDB ID: 64713
LFTP lftpget get1 Command Content-Disposition Header Suggested Filename Arbitrary File Overwrite

Source: BUGTRAQ
Type: UNKNOWN
20101027 rPSA-2010-0073-1 lftp

Source: CCN
Type: BID-43728
LFTP 'Content-Disposition' HTTP Header Arbitrary File Overwrite Vulnerability

Source: VUPEN
Type: Vendor Advisory
ADV-2010-1654

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=591580

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=602836

Source: XF
Type: UNKNOWN
lftp-content-disposition-weak security(58692)

Vulnerable Configuration:

Configuration 1:

cpe:/a:alexander_v._lukyanov:lftp:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.7:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.8:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.9:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.1.10:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.2.0a:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.2.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.2.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.2.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.2.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.7:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.8:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.9:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.10:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.3.11:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.7:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.8:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.9:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.10:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.4.10a:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.5.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.5.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.5.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.5.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.7:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.8:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.9:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.10:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.11:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:2.6.12:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.7:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.8:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.9:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.10:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.11:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.12:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.0.13:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.1.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.1.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.1.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.1.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.2.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.3.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.3.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.3.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.3.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.3.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.3.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.4.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.4.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.4.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.4.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.4.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.4.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.4.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.4.7:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.7:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.8:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.9:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.10:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.11:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.12:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.13:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.14:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.5.15:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.6.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.6.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.6.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.6.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.5:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.6:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.7:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.8:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.9:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.10:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.11:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.12:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.13:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:3.7.14:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:alexander_v._lukyanov:lftp:*:*:*:*:*:*:*:* (Version <= 4.0.5)

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20102251	V	CVE-2010-2251	2015-11-16
oval:org.mitre.oval:def:13484	P	USN-984-1 -- lftp vulnerability	2014-06-30
oval:org.mitre.oval:def:12796	P	DSA-2085-1 lftp -- missing input validation	2014-06-23
oval:org.mitre.oval:def:22803	P	ELSA-2010:0585: lftp security update (Moderate)	2014-05-26
oval:org.mitre.oval:def:22074	P	RHSA-2010:0585: lftp security update (Moderate)	2014-02-24
oval:org.debian:def:2085	V	missing input validation	2010-08-03
oval:com.redhat.rhsa:def:20100585	P	RHSA-2010:0585: lftp security update (Moderate)	2010-08-02