From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 2 Aug 2005 18:01:32 +0200
Subject: [UNIX] ProFTPd Format String Vulnerabilities
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050802162404.50CA85786@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
ProFTPd Format String Vulnerabilities
------------------------------------------------------------------------
SUMMARY
<http://www.proftpd.org/>; ProFTPD is "a configurable GPL-licensed FTP
server software".
Under very specific circumstances, ProFTPD is vulnerable to format string
vulnerabilities, potentially resulting in the execution of arbitrary code.
DETAILS
Vulnerable Systems:
* ProFTPd version 1.3.0rc1 and prior
Immune Systems:
* ProFTPd version 1.3.0rc2
ProFTPD is vulnerable to format string vulnerabilities when displaying a
shutdown message containing the name of the current directory, and when
displaying response messages to the client using information retrieved
from a database using mod_sql.
A remote attacker could create a directory with a malicious name that
would trigger the format string issue if specific variables are used in
the shutdown message, potentially resulting in a Denial of Service or the
execution of arbitrary code with the rights of the user running the
ProFTPD server. An attacker with control over the database contents could
achieve the same result by introducing malicious messages that would
trigger the other format string issue when used in server responses.
Workaround:
Do not use the "%C", "%R", or "%U" in shutdown messages, and do not set
the "SQLShowInfo" directive.
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2390>;
CAN-2005-2390
ADDITIONAL INFORMATION
The information has been provided by <mailto:jaervosz@gentoo.org.> Sune
Kloppenborg Jeppesen .
The original article can be found at:
<http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml>;
http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
