CVE-2018-10916 Path traversal in lftp
A remote attacker can delete all files in the victim's current directory by tricking them into using reverse mirroring on a malicious FTP server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-10916?
CVE-2018-10916 is a medium-severity path traversal vulnerability in Canonical Ubuntu Linux, published on 1 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
Weakness: CWE-20
Which versions are affected by CVE-2018-10916?
It affects 3 products.
Linux distribution packages (21)
lftp Red Hat:enterprise_linux:7::client | All versions | 0:4.4.8-12.el7 |
lftp-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:4.4.8-12.el7 |
lftp-scripts Red Hat:enterprise_linux:7::client | All versions | 0:4.4.8-12.el7 |
lftp Red Hat:enterprise_linux:7::computenode | All versions | 0:4.4.8-12.el7 |
lftp-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:4.4.8-12.el7 |
lftp-scripts Red Hat:enterprise_linux:7::computenode | All versions | 0:4.4.8-12.el7 |
lftp Red Hat:enterprise_linux:7::server | All versions | 0:4.4.8-12.el7 |
lftp-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:4.4.8-12.el7 |
lftp-scripts Red Hat:enterprise_linux:7::server | All versions | 0:4.4.8-12.el7 |
lftp Red Hat:enterprise_linux:7::workstation | All versions | 0:4.4.8-12.el7 |
lftp-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:4.4.8-12.el7 |
lftp-scripts Red Hat:enterprise_linux:7::workstation | All versions | 0:4.4.8-12.el7 |
lftp SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 4.7.4-3.6.1 |
lftp SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 4.7.4-3.6.1 |
lftp SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 4.8.3-4.3.1 |
lftp SUSE:Linux Enterprise Server 12 SP3 | All versions | 4.7.4-3.6.1 |
lftp SUSE:Linux Enterprise Server 12 SP4 | All versions | 4.7.4-3.6.1 |
lftp SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 4.7.4-3.6.1 |
lftp SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 4.7.4-3.6.1 |
lftp openSUSE:Leap 15.0 | All versions | 4.8.3-lp150.3.3.1 |
lftp openSUSE:Tumbleweed | All versions | 4.9.2-1.7 |
Products include Canonical Ubuntu Linux, Lftp Project Lftp, Opensuse Leap.
How do I fix CVE-2018-10916?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-10916 being exploited?
There is no known exploitation of CVE-2018-10916 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-10916, DEBIAN-CVE-2018-10916, GHSA-8mjf-52xq-g6h8, RHSA-2020:1045, SUSE-SU-2019:0642-1, SUSE-SU-2019:0643-1 and 4 more.