Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-8805: ftpsync may allow attackers to access restricted files

CVE-2017-8805 · published 9 years ago

Summary

The ftpsync tool on Debian can be tricked into following symbolic links that point outside the intended directory. This lets a remote attacker read or write files they should not reach. Update ftpsync to the latest version or apply the patch that enables safe link handling.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
debian	ftpsync	<= 20171016 `cpe:2.3:a:debian:ftpsync::::::::`

Original advisory text

Debian ftpsync before 20171017 does not use the rsync --safe-links option, which allows remote attackers to conduct directory traversal attacks via a crafted upstream mirror.

References

http://www.openwall.com/lists/oss-security/2017/10/17/2 Issue Tracking Mailing List Patch Third Party Advisory
https://anonscm.debian.org/cgit/mirror/archvsync.git/commit/?id=d1ca2ab2210990b6... Issue Tracking Patch Vendor Advisory
https://lists.debian.org/debian-mirrors/2017/10/msg00017.html Issue Tracking Mailing List Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.1 Critical

Exploitation

3% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published17 Oct 2017

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-8805 · NVD

Track software like this

Free during beta