Group Access Vulnerability in MIT Kerberos FTP Daemon

CVE-2011-1526

What is CVE-2011-1526?

The MIT Kerberos FTP daemon contains a privilege escalation vulnerability due to improper handling of return values from the krb5_setegid function. This oversight enables remote authenticated users to bypass essential group access restrictions, granting them the ability to create, overwrite, delete, or read files on the system using standard FTP commands. The problem arises from omitted autoconf tests within the configuration script, leading to potential security breaches that could compromise sensitive data.

References