CVE-2011-0988 Privilege escalation in n/a

Medium 4.4 Published 18 Apr 2011 Updated 6 Aug 2024

Local attackers can overwrite arbitrary files and gain privileges due to a world-writeable directory in pure-ftpd when OES Netware extensions are enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2011-0988?

CVE-2011-0988 is a medium-severity vulnerability in n/a, published on 18 Apr 2011. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

pure-ftpd 1.0.22, as used in SUSE Linux Enterprise Server 10 SP3 and SP4, and Enterprise Desktop 10 SP3 and SP4, when running OES Netware extensions, creates a world-writeable directory, which allows local users to overwrite arbitrary files and gain privileges via unspecified vectors.

Weakness: CWE-264

Which versions are affected by CVE-2011-0988?

It affects 2 products.

Products include Novell Suse Linux, Pureftpd Pure-Ftpd.

How do I fix CVE-2011-0988?

No fix has been published for CVE-2011-0988 yet. Limit exposure of the affected software until one is available.

Is CVE-2011-0988 being exploited?

There is no known exploitation of CVE-2011-0988 in the wild and no public exploit code.

Sources

Also known as GHSA-fcmr-8hmm-9f43.