CVE ID:	CVE-2011-1526
Description:	ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.
Test IDs:	1.3.6.1.4.1.25623.1.0.863357   1.3.6.1.4.1.25623.1.0.863345   1.3.6.1.4.1.25623.1.0.69802   1.3.6.1.4.1.25623.1.0.870562   1.3.6.1.4.1.25623.1.0.850296   1.3.6.1.4.1.25623.1.0.870716   1.3.6.1.4.1.25623.1.0.122138   1.3.6.1.4.1.25623.1.0.69935   1.3.6.1.4.1.25623.1.0.69934   1.3.6.1.4.1.25623.1.0.70028   1.3.6.1.4.1.25623.1.0.831430   1.3.6.1.4.1.25623.1.1.4.2012.0042.1   1.3.6.1.4.1.25623.1.0.123967   1.3.6.1.4.1.25623.1.0.70057   1.3.6.1.4.1.25623.1.0.71118   1.3.6.1.4.1.25623.1.0.850204   1.3.6.1.4.1.25623.1.1.4.2012.0050.1
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1526 BugTraq ID: 48571 http://www.securityfocus.com/bid/48571 Bugtraq: 20110705 MITKRB5-SA-2011-005 FTP daemon fails to set effective group ID [CVE-2011-1526] (Google Search) http://www.securityfocus.com/archive/1/518733/100/0/threaded Debian Security Information: DSA-2283 (Google Search) http://www.debian.org/security/2011/dsa-2283 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062681.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062699.html http://www.mandriva.com/security/advisories?name=MDVSA-2011:117 http://www.osvdb.org/73617 RedHat Security Advisories: RHSA-2011:0920 http://www.redhat.com/support/errata/RHSA-2011-0920.html http://secunia.com/advisories/45145 http://secunia.com/advisories/45157 http://secunia.com/advisories/48101 http://securityreason.com/securityalert/8301 SuSE Security Announcement: SUSE-SU-2012:0010 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html SuSE Security Announcement: SUSE-SU-2012:0018 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00004.html SuSE Security Announcement: SUSE-SU-2012:0042 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html SuSE Security Announcement: SUSE-SU-2012:0050 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00011.html SuSE Security Announcement: openSUSE-SU-2011:1169 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html SuSE Security Announcement: openSUSE-SU-2012:0019 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00005.html SuSE Security Announcement: openSUSE-SU-2012:0051 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00014.html XForce ISS Database: kerberos-krb5appl-priv-esc(68398) https://exchange.xforce.ibmcloud.com/vulnerabilities/68398