CVE-2015-3306

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
proftpdproftpd
1.3.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
proftpd-dfsg
bullseye
1.3.7a+dfsg-12+deb11u2
fixed
squeeze
not-affected
bookworm
1.3.8+dfsg-4+deb12u3
fixed
trixie
1.3.8.b+dfsg-2
fixed
sid
1.3.8.b+dfsg-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
proftpd-dfsg
yakkety
not-affected
xenial
not-affected
wily
not-affected
vivid
Fixed 1.3.5-1.1+deb8u1build0.15.04.1
released
utopic
ignored
trusty
Fixed 1.3.5~rc3-2.1ubuntu2.1
released
precise
Fixed 1.3.4a-1ubuntu0.1
released
lucid
ignored
Common Weakness Enumeration
References
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html
http://www.debian.org/security/2015/dsa-3263
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
http://www.securityfocus.com/bid/74238
https://www.exploit-db.com/exploits/36742/
https://www.exploit-db.com/exploits/36803/
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html
http://www.debian.org/security/2015/dsa-3263
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
http://www.securityfocus.com/bid/74238
https://www.exploit-db.com/exploits/36742/
https://www.exploit-db.com/exploits/36803/