Privilege Escalation Vulnerability in linux-ftpd: Directory Listing Exploit
Summary
DEBIAN-CVE-2006-7094: ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privi... Affects linux-ftpd versions < 0.17-23. Fixed in 0.17-23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-ftpd is an FTP server implementation used in Debian-based systems, providing file transfer capabilities over the Internet. It allows users to upload and download files securely. However, due to a flaw in its handling of group IDs, it is vulnerable to privilege escalation, allowing unauthorized directory access.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2006-7094 occurs in the ftpd service used by Gentoo and Debian Linux. It improperly sets the group ID (gid) to the effective user ID (uid) instead of the effective group ID before executing the /bin/ls command. This flaw allows remote authenticated users to list arbitrary directories with the privileges of gid 0 (root), potentially exposing sensitive information and enabling further attacks.
How To Fix
Minimum fixed version
0.17-23
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linux-ftpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the FTP service or disabling it until the package can be updated. You can stop the service with the command:
sudo systemctl stop linux-ftpd
Conclusion
The linux-ftpd package has a significant vulnerability that can lead to unauthorized directory access. It is crucial to update to the latest patched version to mitigate this risk. Users should also consider temporary workarounds while awaiting updates.
See every vulnerability recorded for linux-ftpd →
FAQ
The vulnerability allows authenticated users to list directories they should not have access to, potentially exposing sensitive files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patched version of linux-ftpd (0.17-23) is available. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, consider restricting access to the FTP service or disabling it temporarily.
Detailed information can be found in the Debian CVE database or by visiting the Vulert website.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux-ftpd.
