Vulnerability Details : CVE-2012-6095
ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.
Threat overview for CVE-2012-6095
Top countries where our scanners detected CVE-2012-6095
Top open port discovered on systems with this issue
21
IPs affected by CVE-2012-6095 232,945
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2012-6095!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2012-6095
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-6095
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
1.2
|
LOW | AV:L/AC:H/Au:N/C:N/I:P/A:N |
1.9
|
2.9
|
NIST |
CWE ids for CVE-2012-6095
-
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-6095
-
http://www.openwall.com/lists/oss-security/2013/01/07/3
oss-security - Re: CVE Request -- proFTPD (X < 1.3.5.rc1): Symlink race condition when applying UserOwner to a newly (ProFTPD) created directory
-
http://proftpd.org/docs/NEWS-1.3.5rc1
-
http://bugs.proftpd.org/show_bug.cgi?id=3841
Bug 3841 – Possible symlink race when applying UserOwner to newly created directory
-
http://www.debian.org/security/2013/dsa-2606
Debian -- Security Information -- DSA-2606-1 proftpd-dfsg
Products affected by CVE-2012-6095
- cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.0:rc5:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.10:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.7:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.7:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.5:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.1:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.9:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.9:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.7:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.0:a:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.10:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.10:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.8:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.8:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.5:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.2:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.1:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.1:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.9:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.6:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.2:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.0:pre10:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.2.0:pre9:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.3:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:rc4:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:c:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.3:a:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:a:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:b:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.3:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.3:rc4:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.3:rc2:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:d:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.2:e:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.3:b:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.3:c:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.4:rc3:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:proftpd:proftpd:1.3.4:rc2:*:*:*:*:*:*