It has been discovered that lftp up to and including...
Vulnerability Description
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10916
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/lavv17/lftp/issues/452
- https://usn.ubuntu.com/3731-2/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916
- https://github.com/lavv17/lftp/commit/a27e07d90a4608ceaf928b1babb27d4d803e1992
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00010.html
More from [UNKNOWN]
View All →Affected Vendor
[UNKNOWN]
View all reports →