CVE-2011-1575

medium · 5.8

The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.

5.8

CVSS

33.3%

EPSS (exploit prob.)

98th

EPSS percentile

2011-05-23

Published

AV:N/AC:M/Au:N/C:P/I:P/A:N

Weaknesses

CWE-399

Affected products

Vendor	Product	Affected versions
pureftpd	pure-ftpd	<= 1.0.29
pureftpd	pure-ftpd	0.90
pureftpd	pure-ftpd	0.91
pureftpd	pure-ftpd	0.92
pureftpd	pure-ftpd	0.93
pureftpd	pure-ftpd	0.94
pureftpd	pure-ftpd	0.95
pureftpd	pure-ftpd	0.95-pre1
pureftpd	pure-ftpd	0.95-pre2
pureftpd	pure-ftpd	0.95-pre3
pureftpd	pure-ftpd	0.95-pre4
pureftpd	pure-ftpd	0.95.1
pureftpd	pure-ftpd	0.95.2
pureftpd	pure-ftpd	0.96
pureftpd	pure-ftpd	0.96.1
pureftpd	pure-ftpd	0.96pre1
pureftpd	pure-ftpd	0.97-final
pureftpd	pure-ftpd	0.97.1
pureftpd	pure-ftpd	0.97.2
pureftpd	pure-ftpd	0.97.3
pureftpd	pure-ftpd	0.97.4
pureftpd	pure-ftpd	0.97.5
pureftpd	pure-ftpd	0.97.6
pureftpd	pure-ftpd	0.97.7
pureftpd	pure-ftpd	0.97.7pre1
pureftpd	pure-ftpd	0.97.7pre2
pureftpd	pure-ftpd	0.97.7pre3
pureftpd	pure-ftpd	0.97pre1
pureftpd	pure-ftpd	0.97pre2
pureftpd	pure-ftpd	0.97pre3
pureftpd	pure-ftpd	0.97pre4
pureftpd	pure-ftpd	0.97pre5
pureftpd	pure-ftpd	0.98-final
pureftpd	pure-ftpd	0.98.1
pureftpd	pure-ftpd	0.98.2
pureftpd	pure-ftpd	0.98.2a
pureftpd	pure-ftpd	0.98.3
pureftpd	pure-ftpd	0.98.4
pureftpd	pure-ftpd	0.98.5
pureftpd	pure-ftpd	0.98.6

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2011-1575