The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5177-1 advisory.

    It was discovered that Inetutils did not properly check the response of ftp requests. A remote attacker     could use this vulnerability to cause a crash or run programs in the user machine.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3205 advisory.

  - Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to     stack-based buffer overflows, which can be exploited to bypass veriexec restrictions on Junos OS. A stack-     based overflow is present in the handling of environment variables when connecting via the telnet client     to remote telnet servers. This issue only affects the telnet client  accessible from the CLI or shell     in Junos OS. Inbound telnet services are not affected by this issue. This issue affects: Juniper Networks     Junos OS: 12.3 versions prior to 12.3R12-S13; 12.3X48 versions prior to 12.3X48-D80; 14.1X53 versions     prior to 14.1X53-D130, 14.1X53-D49; 15.1 versions prior to 15.1F6-S12, 15.1R7-S4; 15.1X49 versions prior     to 15.1X49-D170; 15.1X53 versions prior to 15.1X53-D237, 15.1X53-D496, 15.1X53-D591, 15.1X53-D69; 16.1     versions prior to 16.1R3-S11, 16.1R7-S4; 16.2 versions prior to 16.2R2-S9; 17.1 versions prior to 17.1R3;
    17.2 versions prior to 17.2R1-S8, 17.2R2-S7, 17.2R3-S1; 17.3 versions prior to 17.3R3-S4; 17.4 versions     prior to 17.4R1-S6, 17.4R2-S3, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to     18.2R1-S5, 18.2R2-S2, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3,     18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. (CVE-2019-0053)

  - A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to     a given IP address and port, and this way potentially make curl extract information about services that     are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
    (CVE-2020-8284)

  - The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to     make sure they match the server address. This is similar to CVE-2020-8284 for curl. (CVE-2021-40491)

  - telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer     dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but     the telnet service would remain available through inetd. However, if the telnetd application has many     crashes within a short time interval, the telnet service would become unavailable after inetd logs a     telnet/tcp server failing (looping), service terminated error. NOTE: MIT krb5-appl is not supported     upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT     Kerberos 5 (aka krb5) product many years ago, at version 1.8. (CVE-2022-39028)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
183129	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Inetutils vulnerability (USN-5177-1)	Nessus	Ubuntu Local Security Checks	medium
168204	Debian DLA-3205-1 : inetutils - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-40491

medium

Tenable Plugins

medium

high