CVE-2010-2251 Path traversal in n/a

High 7.5 Published 6 Jul 2010 Updated 7 Aug 2024

A malicious server can overwrite arbitrary files or execute code via crafted Content-Disposition headers in LFTP downloads.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2010-2251?

CVE-2010-2251 is a high-severity path traversal vulnerability in n/a, published on 6 Jul 2010. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The get1 command, as used by lftpget, in LFTP before 4.0.6 does not properly validate a server-provided filename before determining the destination filename of a download, which allows remote servers to create or overwrite arbitrary files via a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

Weakness: CWE-20

Which versions are affected by CVE-2010-2251?

It affects 1 product.

Linux distribution packages (4)

`lftp` Red Hat:enterprise_linux:5::client	All versions	`0:3.7.11-4.el5_5.3`
`lftp-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:3.7.11-4.el5_5.3`
`lftp` Red Hat:enterprise_linux:5::server	All versions	`0:3.7.11-4.el5_5.3`
`lftp-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:3.7.11-4.el5_5.3`

Products include Alexander v. Lukyanov Lftp.

How do I fix CVE-2010-2251?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2010-2251 being exploited?

There is no known exploitation of CVE-2010-2251 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2010-2251, DSA-2085-1, GHSA-96vc-4h75-gh5j, RHSA-2010:0585.