Summary
The remote host is missing an update to krb5-appl
announced via advisory DSA 2283-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202283-1
Insight
Tim Zingelmann discovered that due an incorrect configure script the kerborised FTP server failed to set the effective GID correctly, resulting in privilege escalation.
The oldstable distribution (lenny) is not affected.
For the stable distribution (squeeze), this problem has been fixed in version 1.0.1-1.1.
For the unstable distribution (sid), this problem will be fixed soon.
We recommend that you upgrade your krb5-appl packages.
Severity
Classification
-
CVE CVE-2011-1526 -
CVSS Base Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P
Related Vulnerabilities