Description
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | krb5-appl | 1:1.0.1-1.1 | DSA-2283-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | krb5-appl +2 | 1.0.1-2.el6_1.1 | RHSA-2011:0920 |
| RHEL 5 | krb5 +5 | 1.6.1-70.el5 | RHSA-2012:0306 |
Advisories 3
- RHSA-2012:0306 Red Hat Security Advisory: krb5 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2283-1 krb5-appl - programming error Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2011:0920 Red Hat Security Advisory: krb5-appl security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- SUSE-SU-2012:0042 vendor-advisory
- SUSE-SU-2012:0018 vendor-advisory
- RHSA-2011:0920 vendor-advisory
- 48101 third-party-advisory
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt
- openSUSE-SU-2011:1169 vendor-advisory
- openSUSE-SU-2012:0019 vendor-advisory
- kerberos-krb5appl-priv-esc(68398) vdb-entry
- SUSE-SU-2012:0050 vendor-advisory
- 45145 third-party-advisory
- openSUSE-SU-2012:0051 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=711419
- SUSE-SU-2012:0010 vendor-advisory
- 45157 third-party-advisory
- 8301 third-party-advisory
- MDVSA-2011:117 vendor-advisory
- FEDORA-2011-9109 vendor-advisory
- 48571 vdb-entry
- 73617 vdb-entry
- DSA-2283 vendor-advisory
- 20110705 MITKRB5-SA-2011-005 FTP daemon fails to set effective group ID [CVE-2011-1526] mailing-list
- FEDORA-2011-9080 vendor-advisory