CVE-2015-3306
None CISA KEVCVSS
—
EPSS
99.5%
Published
May 18, 2015
CISA due date
Oct 11, 2026
The record
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | proftpd-dfsg | 0 | 1.3.5-2 |
| Debian:12 | proftpd-dfsg | 0 | 1.3.5-2 |
| Debian:13 | proftpd-dfsg | 0 | 1.3.5-2 |
| Debian:7 | proftpd-dfsg | 0 | 1.3.4a-5+deb7u3 |
| Debian:8 | proftpd-dfsg | 0 | 1.3.5-1.1+deb8u1 |
| Ubuntu:14.04:LTS | proftpd-dfsg | 0 | 1.3.5~rc3-2.1ubuntu2.1 |
| Ubuntu:16.04:LTS | proftpd-dfsg | 0 | 1.3.5-2 |
| openSUSE:Tumbleweed | proftpd | 0 | 1.3.5b-2.5 |
Related vulnerabilities
- CVE-2024-48651 In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants… Also affects proftpd-dfsg
- CVE-2011-4130 Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote… Also affects proftpd-dfsg
- CVE-2011-1137 Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows… Also affects proftpd-dfsg
- CVE-2010-4652 Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in… Also affects proftpd-dfsg
- CVE-2010-4221 Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in… Also affects proftpd-dfsg
- CVE-2009-0543 ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL… Also affects proftpd-dfsg
- CVE-2009-0542 SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote… Also affects proftpd-dfsg
- CVE-2007-2165 The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication… Also affects proftpd-dfsg