CVE:CVE-2011-3171
CNNVD:CNNVD-201109-132
Pure-FTPd是一款流行的FTP服务程序。
Pure-FTPd中存在本地文件覆盖漏洞。借助用户名传递的输入在认证过程中没有经过正确过滤，远程攻击者可借助目录遍历序列创建任意目录。
solution:Upgrade pureftpd pure-ftpd to a higher version than 1.0.22,0.90,0.91,0.92,0.93,0.94,0.95,0.95:pre1,0.95:pre2,0.95:pre3,0.95:pre4,0.95.1,0.95.2,0.96,0.96:pre1,0.96.1,0.97:pre1,0.97:pre2,0.97:pre3,0.97:pre4,0.97:pre5,0.97-final,0.97.1,0.97.2,0.97.3,0.97.4,0.97.5,0.97.6,0.97.7,0.97.7:pre1,0.97.7:pre2,0.97.7:pre3,0.98:final,0.98:pre1,0.98:pre2,0.98.1,0.98.2,0.98.2:a,0.98.3,0.98.4,0.98.5,0.98.6,0.98.7,0.99,0.99:a,0.99:b,0.99:pre1,0.99:pre2,0.99.1,0.99.1:a,0.99.1:b,0.99.2,0.99.2:a,0.99.3,0.99.4,0.99.9,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.0.9,1.0.10,1.0.11,1.0.12,1.0.13:a,1.0.14,1.0.15,1.0.16:a,1.0.16:b,1.0.16:c,1.0.17,1.0.17:a,1.0.18,1.0.19,1.0.20,1.0.21,and avoid the version (,1.0.22],0.90,0.91,0.92,0.93,0.94,0.95,0.95:pre1,0.95:pre2,0.95:pre3,0.95:pre4,0.95.1,0.95.2,0.96,0.96:pre1,0.96.1,0.97:pre1,0.97:pre2,0.97:pre3,0.97:pre4,0.97:pre5,0.97-final,0.97.1,0.97.2,0.97.3,0.97.4,0.97.5,0.97.6,0.97.7,0.97.7:pre1,0.97.7:pre2,0.97.7:pre3,0.98:final,0.98:pre1,0.98:pre2,0.98.1,0.98.2,0.98.2:a,0.98.3,0.98.4,0.98.5,0.98.6,0.98.7,0.99,0.99:a,0.99:b,0.99:pre1,0.99:pre2,0.99.1,0.99.1:a,0.99.1:b,0.99.2,0.99.2:a,0.99.3,0.99.4,0.99.9,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.7,1.0.8,1.0.9,1.0.10,1.0.11,1.0.12,1.0.13:a,1.0.14,1.0.15,1.0.16:a,1.0.16:b,1.0.16:c,1.0.17,1.0.17:a,1.0.18,1.0.19,1.0.20,1.0.21