6.8 - CVE-2009-0543

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2009-0543	First vendor Publication	2009-02-12
Vendor	Cve	Last vendor Modification	2009-06-09

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0543

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-89	Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12886

Oval ID:	oval:org.mitre.oval:def:12886
Title:	DSA-1727-1 proftpd-dfsg -- SQL injection vulnerabilites
Description:	Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0542 Shino discovered that proftpd is prone to an SQL injection vulnerability via the use of certain characters in the username. CVE-2009-0543 TJ Saunders discovered that proftpd is prone to an SQL injection vulnerability due to insufficient escaping mechanisms, when multybite character encodings are used. For the stable distribution, these problems have been fixed in version 1.3.1-17lenny1. For the oldstable distribution, these problems will be fixed soon. For the testing distribution, these problems will be fixed soon. For the unstable distribution, these problems have been fixed in version 1.3.2-1. We recommend that you upgrade your proftpd-dfsg package.
Family:	unix	Class:	patch
Reference(s):	DSA-1727-1 CVE-2009-0542 CVE-2009-0543	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd DPKG is earlier than 1.3.1-17lenny1 AND proftpd-doc DPKG is earlier than 1.3.1-17lenny1 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is mips AND Installed architecture is mipsel AND Installed architecture is arm AND Packages section proftpd-mod-mysql DPKG is earlier than 1.3.1-17lenny1 AND proftpd-mod-pgsql DPKG is earlier than 1.3.1-17lenny1 AND proftpd-mod-ldap DPKG is earlier than 1.3.1-17lenny1 AND proftpd-basic DPKG is earlier than 1.3.1-17lenny1

Definition Id: oval:org.mitre.oval:def:13553

Oval ID:	oval:org.mitre.oval:def:13553
Title:	DSA-1730-1 proftpd-dfsg -- SQL injection vulnerabilites
Description:	The security update for proftpd-dfsg in DSA-1727-1 caused a regression with the postgresql backend. This update corrects the flaw. Also it was discovered that the oldstable distribution is not affected by the security issues. For reference the original advisory follows. Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0542 Shino discovered that proftpd is prone to an SQL injection vulnerability via the use of certain characters in the username. CVE-2009-0543 TJ Saunders discovered that proftpd is prone to an SQL injection vulnerability due to insufficient escaping mechanisms, when multybite character encodings are used. For the stable distribution, these problems have been fixed in version 1.3.1-17lenny2. The oldstable distribution is not affected by these problems. For the unstable distribution, these problems have been fixed in version 1.3.2-1. For the testing distribution, these problems will be fixed soon.
Family:	unix	Class:	patch
Reference(s):	DSA-1730-1 CVE-2009-0542 CVE-2009-0543	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd DPKG is earlier than 1.3.1-17lenny2 AND proftpd-doc DPKG is earlier than 1.3.1-17lenny2 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is mipsel AND Installed architecture is arm AND Packages section proftpd-mod-mysql DPKG is earlier than 1.3.1-17lenny2 AND proftpd-mod-pgsql DPKG is earlier than 1.3.1-17lenny2 AND proftpd-mod-ldap DPKG is earlier than 1.3.1-17lenny2 AND proftpd-basic DPKG is earlier than 1.3.1-17lenny2

Definition Id: oval:org.mitre.oval:def:7391

Oval ID:	oval:org.mitre.oval:def:7391
Title:	DSA-1730 proftpd-dfsg -- SQL injection vulnerabilities
Description:	The security update for proftpd-dfsg in DSA-1727-1 caused a regression with the postgresql backend. This update corrects the flaw. Also it was discovered that the oldstable distribution (etch) is not affected by the security issues. For reference the original advisory follows. Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: Shino discovered that proftpd is prone to an SQL injection vulnerability via the use of certain characters in the username. TJ Saunders discovered that proftpd is prone to an SQL injection vulnerability due to insufficient escaping mechanisms, when multybite character encodings are used. The oldstable distribution (etch) is not affected by these problems.
Family:	unix	Class:	patch
Reference(s):	DSA-1730 CVE-2009-0542 CVE-2009-0543	Version:	4
Platform(s):	Debian GNU/Linux 5.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd is earlier than 1.3.1-17lenny2 AND proftpd-doc is earlier than 1.3.1-17lenny2 AND proftpd-mod-mysql is earlier than 1.3.1-17lenny2 AND proftpd-mod-pgsql is earlier than 1.3.1-17lenny2 AND proftpd-mod-ldap is earlier than 1.3.1-17lenny2 AND proftpd-basic is earlier than 1.3.1-17lenny2

Definition Id: oval:org.mitre.oval:def:7963

Oval ID:	oval:org.mitre.oval:def:7963
Title:	DSA-1727 proftpd-dfsg -- SQL injection vulnerabilities
Description:	Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: Shino discovered that proftpd is prone to an SQL injection vulnerability via the use of certain characters in the username. TJ Saunders discovered that proftpd is prone to an SQL injection vulnerability due to insufficient escaping mechanisms, when multybite character encodings are used.
Family:	unix	Class:	patch
Reference(s):	DSA-1727 CVE-2009-0542 CVE-2009-0543	Version:	3
Platform(s):	Debian GNU/Linux 5.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd is earlier than 1.3.1-17lenny1 AND proftpd-doc is earlier than 1.3.1-17lenny1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is mips AND Installed architecture is mipsel AND Installed architecture is arm AND Packages section proftpd-mod-mysql is earlier than 1.3.1-17lenny1 AND proftpd-mod-pgsql is earlier than 1.3.1-17lenny1 AND proftpd-mod-ldap is earlier than 1.3.1-17lenny1 AND proftpd-basic is earlier than 1.3.1-17lenny1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Proftpd cpe:2.3:a:proftpd:proftpd:1.3.1:::::::*	1

OpenVAS Exploits

Date	Description
2009-06-05	Name : Ubuntu USN-723-1 (git-core) File : nvt/ubuntu_723_1.nasl
2009-03-20	Name : Debian Security Advisory DSA 1727-1 (proftpd-dfsg) File : nvt/deb_1727_1.nasl
2009-03-20	Name : FreeBSD Ports: proftpd, proftpd-mysql File : nvt/freebsd_proftpd5.nasl
2009-03-13	Name : Gentoo Security Advisory GLSA 200903-27 (proftpd) File : nvt/glsa_200903_27.nasl
2009-03-07	Name : Debian Security Advisory DSA 1730-1 (proftpd-dfsg) File : nvt/deb_1730_1.nasl
2009-02-20	Name : ProFTPD Server SQL Injection Vulnerability File : nvt/secpod_proftpd_server_sql_inj_vuln.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
51954	ProFTPD Server NLS Support mod_sql_* Encoded Multibyte Character SQL Injectio...
51849	ProFTPD Character Encoding SQL Injection ProFTPD contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to an unspecified function not properly sanitizing user-supplied input to the username and password parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

Nessus® Vulnerability Scanner

Date	Description
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-061.nasl - Type : ACT_GATHER_INFO
2009-03-17	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_ca0841ff125411dea9640030843d3802.nasl - Type : ACT_GATHER_INFO
2009-03-13	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200903-27.nasl - Type : ACT_GATHER_INFO
2009-03-03	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1730.nasl - Type : ACT_GATHER_INFO
2009-02-26	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1727.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
CONFIRM	http://bugs.proftpd.org/show_bug.cgi?id=3173
DEBIAN	http://www.debian.org/security/2009/dsa-1730
GENTOO	http://security.gentoo.org/glsa/glsa-200903-27.xml
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:061
MLIST	http://www.openwall.com/lists/oss-security/2009/02/11/4 http://www.openwall.com/lists/oss-security/2009/02/11/5
SECUNIA	http://secunia.com/advisories/34268

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-05-04 12:09:08	Multiple Updates
2021-04-22 01:09:28	Multiple Updates
2020-05-23 00:23:20	Multiple Updates
2016-04-26 18:38:05	Multiple Updates
2016-04-05 13:25:36	Multiple Updates
2014-02-17 10:48:47	Multiple Updates
2013-05-10 23:44:11	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	4
CPE ID(s)	1
Sources(s)	7
osvdb(s)	2
Openvas Exploit(s)	6
Nessus® Exploit(s)	5

	Related
7.5	MDVSA-2009:061
7.5	GLSA-200903-27
7.5	DSA-1730
7.5	DSA-1727
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)