CVE-2011-1575 [中] | Command Injection（Pure-Ftpd）

CVE-2011-1575 綜合評估為中等風險（62.6/100）：CVSS 技術影響為中級，利用機率偏高（EPSS 33.34%，百分位 98%） EPSS 顯示該漏洞近期被利用的可能性處於高位。近一日 EPSS 上升 +11.16%，被利用關注度持續升高。被利用機率偏高—請盤點暴露面並優先安排修補。

#	日期	舊 EPSS 分數	新 EPSS 分數	變化（新 − 舊）
1	2026-06-15	22.18%	33.34%	+11.16%
2	2025-03-30	38.78%	22.18%	-16.59%
3	2025-03-29	—	38.78%	—

日期

舊 EPSS 分數

新 EPSS 分數

變化（新 − 舊）

2026-06-15

22.18%

33.34%

+11.16%

2025-03-30

38.78%

22.18%

-16.59%

2025-03-29

—

38.78%

—

底座分	版本	嚴重度	向量	可利用性	影響	分數來源
5.8	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:P/I:P/A:N` 點擊展開存取路徑 (AV:N) 只要路由可達，即可從遠端發動利用。存取複雜度 (AC:M) 需要若干有利條件，但不必「千年一遇」。認證 (AU:N) 全程無需有效身分。機密性影響 (C:P) 機密性受到部分損害。完整性影響 (I:P) 完整性受到部分損害。可用性影響 (A:N) 對可用性無影響。	8.6	4.9	[email protected]

底座分

版本

嚴重度

向量

可利用性

影響

分數來源

5.8

2.0

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:N 點擊展開

存取路徑 (AV:N): 只要路由可達，即可從遠端發動利用。
存取複雜度 (AC:M): 需要若干有利條件，但不必「千年一遇」。
認證 (AU:N): 全程無需有效身分。
機密性影響 (C:P): 機密性受到部分損害。
完整性影響 (I:P): 完整性受到部分損害。
可用性影響 (A:N): 對可用性無影響。

8.6

4.9

[email protected]

CVE-2011-1575 的 OS 追蹤

vendor	priority	summary	link
`debian`	low	CVE-2011-1575 low priority: Debian including 1 source packages (pure-ftpd), 4 status rows across 4 suites (bookworm, bullseye, sid, trixie): resolved 4.	https://security-tracker.debian.org/tracker/CVE-2011-1575
`gentoo`	normal	CVE-2011-1575: 1 GLSA(s) (201110-25), 1 atom(s) (net-ftp/pure-ftpd); latest impact normal.	https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2011-1575
`ubuntu`	high	CVE-2011-1575 high priority: Ubuntu including 1 source packages (pure-ftpd), 11 status rows across 11 suites (dapper, hardy, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, upstream): ignored 5, not-affected 5, released 1.	https://ubuntu.com/security/CVE-2011-1575

CVE-2011-1575 的影響軟體 / 設定

廠商	產品	版本	原始 CPE
pureftpd	pure-ftpd	<= 1.0.29	cpe:2.3:a:pureftpd:pure-ftpd::::::::
pureftpd	pure-ftpd	0.90	cpe:2.3:a:pureftpd:pure-ftpd:0.90:::::::*
pureftpd	pure-ftpd	0.91	cpe:2.3:a:pureftpd:pure-ftpd:0.91:::::::*
pureftpd	pure-ftpd	0.92	cpe:2.3:a:pureftpd:pure-ftpd:0.92:::::::*
pureftpd	pure-ftpd	0.93	cpe:2.3:a:pureftpd:pure-ftpd:0.93:::::::*
pureftpd	pure-ftpd	0.94	cpe:2.3:a:pureftpd:pure-ftpd:0.94:::::::*
pureftpd	pure-ftpd	0.95	cpe:2.3:a:pureftpd:pure-ftpd:0.95:::::::*
pureftpd	pure-ftpd	0.95-pre1	cpe:2.3:a:pureftpd:pure-ftpd:0.95-pre1:::::::*
pureftpd	pure-ftpd	0.95-pre2	cpe:2.3:a:pureftpd:pure-ftpd:0.95-pre2:::::::*
pureftpd	pure-ftpd	0.95-pre3	cpe:2.3:a:pureftpd:pure-ftpd:0.95-pre3:::::::*
pureftpd	pure-ftpd	0.95-pre4	cpe:2.3:a:pureftpd:pure-ftpd:0.95-pre4:::::::*
pureftpd	pure-ftpd	0.95.1	cpe:2.3:a:pureftpd:pure-ftpd:0.95.1:::::::*
pureftpd	pure-ftpd	0.95.2	cpe:2.3:a:pureftpd:pure-ftpd:0.95.2:::::::*
pureftpd	pure-ftpd	0.96	cpe:2.3:a:pureftpd:pure-ftpd:0.96:::::::*
pureftpd	pure-ftpd	0.96.1	cpe:2.3:a:pureftpd:pure-ftpd:0.96.1:::::::*
pureftpd	pure-ftpd	0.96pre1	cpe:2.3:a:pureftpd:pure-ftpd:0.96pre1:::::::*
pureftpd	pure-ftpd	0.97-final	cpe:2.3:a:pureftpd:pure-ftpd:0.97-final:::::::*
pureftpd	pure-ftpd	0.97.1	cpe:2.3:a:pureftpd:pure-ftpd:0.97.1:::::::*
pureftpd	pure-ftpd	0.97.2	cpe:2.3:a:pureftpd:pure-ftpd:0.97.2:::::::*
pureftpd	pure-ftpd	0.97.3	cpe:2.3:a:pureftpd:pure-ftpd:0.97.3:::::::*
pureftpd	pure-ftpd	0.97.4	cpe:2.3:a:pureftpd:pure-ftpd:0.97.4:::::::*
pureftpd	pure-ftpd	0.97.5	cpe:2.3:a:pureftpd:pure-ftpd:0.97.5:::::::*
pureftpd	pure-ftpd	0.97.6	cpe:2.3:a:pureftpd:pure-ftpd:0.97.6:::::::*
pureftpd	pure-ftpd	0.97.7	cpe:2.3:a:pureftpd:pure-ftpd:0.97.7:::::::*
pureftpd	pure-ftpd	0.97.7pre1	cpe:2.3:a:pureftpd:pure-ftpd:0.97.7pre1:::::::*
pureftpd	pure-ftpd	0.97.7pre2	cpe:2.3:a:pureftpd:pure-ftpd:0.97.7pre2:::::::*
pureftpd	pure-ftpd	0.97.7pre3	cpe:2.3:a:pureftpd:pure-ftpd:0.97.7pre3:::::::*
pureftpd	pure-ftpd	0.97pre1	cpe:2.3:a:pureftpd:pure-ftpd:0.97pre1:::::::*
pureftpd	pure-ftpd	0.97pre2	cpe:2.3:a:pureftpd:pure-ftpd:0.97pre2:::::::*
pureftpd	pure-ftpd	0.97pre3	cpe:2.3:a:pureftpd:pure-ftpd:0.97pre3:::::::*
pureftpd	pure-ftpd	0.97pre4	cpe:2.3:a:pureftpd:pure-ftpd:0.97pre4:::::::*
pureftpd	pure-ftpd	0.97pre5	cpe:2.3:a:pureftpd:pure-ftpd:0.97pre5:::::::*
pureftpd	pure-ftpd	0.98-final	cpe:2.3:a:pureftpd:pure-ftpd:0.98-final:::::::*
pureftpd	pure-ftpd	0.98.1	cpe:2.3:a:pureftpd:pure-ftpd:0.98.1:::::::*
pureftpd	pure-ftpd	0.98.2	cpe:2.3:a:pureftpd:pure-ftpd:0.98.2:::::::*
pureftpd	pure-ftpd	0.98.2a	cpe:2.3:a:pureftpd:pure-ftpd:0.98.2a:::::::*
pureftpd	pure-ftpd	0.98.3	cpe:2.3:a:pureftpd:pure-ftpd:0.98.3:::::::*
pureftpd	pure-ftpd	0.98.4	cpe:2.3:a:pureftpd:pure-ftpd:0.98.4:::::::*
pureftpd	pure-ftpd	0.98.5	cpe:2.3:a:pureftpd:pure-ftpd:0.98.5:::::::*
pureftpd	pure-ftpd	0.98.6	cpe:2.3:a:pureftpd:pure-ftpd:0.98.6:::::::*
pureftpd	pure-ftpd	0.98.7	cpe:2.3:a:pureftpd:pure-ftpd:0.98.7:::::::*
pureftpd	pure-ftpd	0.98pre1	cpe:2.3:a:pureftpd:pure-ftpd:0.98pre1:::::::*
pureftpd	pure-ftpd	0.98pre2	cpe:2.3:a:pureftpd:pure-ftpd:0.98pre2:::::::*
pureftpd	pure-ftpd	0.99	cpe:2.3:a:pureftpd:pure-ftpd:0.99:::::::*
pureftpd	pure-ftpd	0.99.1	cpe:2.3:a:pureftpd:pure-ftpd:0.99.1:::::::*
pureftpd	pure-ftpd	0.99.1a	cpe:2.3:a:pureftpd:pure-ftpd:0.99.1a:::::::*
pureftpd	pure-ftpd	0.99.1b	cpe:2.3:a:pureftpd:pure-ftpd:0.99.1b:::::::*
pureftpd	pure-ftpd	0.99.2	cpe:2.3:a:pureftpd:pure-ftpd:0.99.2:::::::*
pureftpd	pure-ftpd	0.99.2a	cpe:2.3:a:pureftpd:pure-ftpd:0.99.2a:::::::*
pureftpd	pure-ftpd	0.99.3	cpe:2.3:a:pureftpd:pure-ftpd:0.99.3:::::::*
pureftpd	pure-ftpd	0.99.4	cpe:2.3:a:pureftpd:pure-ftpd:0.99.4:::::::*
pureftpd	pure-ftpd	0.99.9	cpe:2.3:a:pureftpd:pure-ftpd:0.99.9:::::::*
pureftpd	pure-ftpd	0.99a	cpe:2.3:a:pureftpd:pure-ftpd:0.99a:::::::*
pureftpd	pure-ftpd	0.99b	cpe:2.3:a:pureftpd:pure-ftpd:0.99b:::::::*
pureftpd	pure-ftpd	0.99pre1	cpe:2.3:a:pureftpd:pure-ftpd:0.99pre1:::::::*
pureftpd	pure-ftpd	0.99pre2	cpe:2.3:a:pureftpd:pure-ftpd:0.99pre2:::::::*
pureftpd	pure-ftpd	1.0.0	cpe:2.3:a:pureftpd:pure-ftpd:1.0.0:::::::*
pureftpd	pure-ftpd	1.0.1	cpe:2.3:a:pureftpd:pure-ftpd:1.0.1:::::::*
pureftpd	pure-ftpd	1.0.2	cpe:2.3:a:pureftpd:pure-ftpd:1.0.2:::::::*
pureftpd	pure-ftpd	1.0.3	cpe:2.3:a:pureftpd:pure-ftpd:1.0.3:::::::*
pureftpd	pure-ftpd	1.0.4	cpe:2.3:a:pureftpd:pure-ftpd:1.0.4:::::::*
pureftpd	pure-ftpd	1.0.5	cpe:2.3:a:pureftpd:pure-ftpd:1.0.5:::::::*
pureftpd	pure-ftpd	1.0.6	cpe:2.3:a:pureftpd:pure-ftpd:1.0.6:::::::*
pureftpd	pure-ftpd	1.0.7	cpe:2.3:a:pureftpd:pure-ftpd:1.0.7:::::::*
pureftpd	pure-ftpd	1.0.8	cpe:2.3:a:pureftpd:pure-ftpd:1.0.8:::::::*
pureftpd	pure-ftpd	1.0.9	cpe:2.3:a:pureftpd:pure-ftpd:1.0.9:::::::*
pureftpd	pure-ftpd	1.0.10	cpe:2.3:a:pureftpd:pure-ftpd:1.0.10:::::::*
pureftpd	pure-ftpd	1.0.11	cpe:2.3:a:pureftpd:pure-ftpd:1.0.11:::::::*
pureftpd	pure-ftpd	1.0.12	cpe:2.3:a:pureftpd:pure-ftpd:1.0.12:::::::*
pureftpd	pure-ftpd	1.0.13a	cpe:2.3:a:pureftpd:pure-ftpd:1.0.13a:::::::*
pureftpd	pure-ftpd	1.0.14	cpe:2.3:a:pureftpd:pure-ftpd:1.0.14:::::::*
pureftpd	pure-ftpd	1.0.15	cpe:2.3:a:pureftpd:pure-ftpd:1.0.15:::::::*
pureftpd	pure-ftpd	1.0.16a	cpe:2.3:a:pureftpd:pure-ftpd:1.0.16a:::::::*
pureftpd	pure-ftpd	1.0.16b	cpe:2.3:a:pureftpd:pure-ftpd:1.0.16b:::::::*
pureftpd	pure-ftpd	1.0.16c	cpe:2.3:a:pureftpd:pure-ftpd:1.0.16c:::::::*
pureftpd	pure-ftpd	1.0.17	cpe:2.3:a:pureftpd:pure-ftpd:1.0.17:::::::*
pureftpd	pure-ftpd	1.0.17a	cpe:2.3:a:pureftpd:pure-ftpd:1.0.17a:::::::*
pureftpd	pure-ftpd	1.0.18	cpe:2.3:a:pureftpd:pure-ftpd:1.0.18:::::::*
pureftpd	pure-ftpd	1.0.19	cpe:2.3:a:pureftpd:pure-ftpd:1.0.19:::::::*
pureftpd	pure-ftpd	1.0.20	cpe:2.3:a:pureftpd:pure-ftpd:1.0.20:::::::*

CVE-2011-1575 的參考連結

URL	標籤
http://archives.pureftpd.org/archives.cgi?100:mss:3906:201103:cpeojfkblajnpinkeadd
http://archives.pureftpd.org/archives.cgi?100:mss:3910:201103:cpeojfkblajnpinkeadd	Patch
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
http://lists.opensuse.org/opensuse-updates/2011-05/msg00029.html
http://openwall.com/lists/oss-security/2011/04/11/14
http://openwall.com/lists/oss-security/2011/04/11/3
http://openwall.com/lists/oss-security/2011/04/11/7
http://openwall.com/lists/oss-security/2011/04/11/8
http://secunia.com/advisories/43988	Vendor Advisory
http://secunia.com/advisories/44548
http://www.pureftpd.org/project/pure-ftpd/news
https://bugzilla.novell.com/show_bug.cgi?id=686590	Patch
https://bugzilla.redhat.com/show_bug.cgi?id=683221
https://github.com/jedisct1/pure-ftpd/commit/65c4d4ad331e94661de763e9b5304d28698999c4	Patch

URL

標籤

http://archives.pureftpd.org/archives.cgi?100:mss:3906:201103:cpeojfkblajnpinkeadd

http://archives.pureftpd.org/archives.cgi?100:mss:3910:201103:cpeojfkblajnpinkeadd

Patch

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html

http://lists.opensuse.org/opensuse-updates/2011-05/msg00029.html

http://openwall.com/lists/oss-security/2011/04/11/14

http://openwall.com/lists/oss-security/2011/04/11/3

http://openwall.com/lists/oss-security/2011/04/11/7

http://openwall.com/lists/oss-security/2011/04/11/8

http://secunia.com/advisories/43988