CVE-2015-1419 Auth bypass in n/a
Remote attackers can bypass access restrictions in vsftpd due to improper deny_file parsing, allowing unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1419?
CVE-2015-1419 is a medium-severity authentication bypass vulnerability in Opensuse Opensuse, published on 28 Jan 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
Which versions are affected by CVE-2015-1419?
It affects 2 products.
Linux distribution packages (3)
vsftpd SUSE:Linux Enterprise Server 12 | All versions | 3.0.2-18.1 |
vsftpd SUSE:Linux Enterprise Server for SAP Applications 12 | All versions | 3.0.2-18.1 |
vsftpd openSUSE:Tumbleweed | All versions | 3.0.3-7.1 |
Products include Opensuse Opensuse, Vsftpd Project Vsftpd.
How do I fix CVE-2015-1419?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2015-1419 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-1419 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as DEBIAN-CVE-2015-1419, GHSA-2r24-78wj-92qx, MGASA-2015-0103, SUSE-RU-2015:0952-1, SUSE-SU-2015:0417-1, SUSE-SU-2015:0516-1 and 2 more.