Pyftpd 0.8.4 creates log files with predictable names in a temporary directory, which allows local users to cause a denial of service and obtain sensitive information.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pyftpd | Radovan_garabik | 0.8.4 (including) | 0.8.4 (including) |
| Pyftpd | Ubuntu | dapper | * |
| Pyftpd | Ubuntu | hardy | * |
| Pyftpd | Ubuntu | jaunty | * |
| Pyftpd | Ubuntu | karmic | * |
| Pyftpd | Ubuntu | lucid | * |
| Pyftpd | Ubuntu | upstream | * |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=585773
- http://www.openwall.com/lists/oss-security/2010/06/13/1
- http://www.securityfocus.com/bid/40842
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59429
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=585773
- http://www.openwall.com/lists/oss-security/2010/06/13/1
- http://www.securityfocus.com/bid/40842
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59429