Executive Summary

Summary
Title Updated i386 proftpd packages fix format string vulnerability
Informations
Name DSA-795 First vendor Publication 2005-09-01
Vendor Debian Last vendor Modification 2005-09-02
Severity (Vendor) N/A Revision 2

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:P)
Cvss Base Score 6.4 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

infamous42md reported that proftpd suffers from two format string vulnerabilities. In the first, a user with the ability to create a directory could trigger the format string error if there is a proftpd shutdown message configured to use the "%C", "%R", or "%U" variables. In the second, the error is triggered if mod_sql is used to retrieve messages from a database and if format strings have been inserted into the database by a user with permission to do so.

There was a build error for the sarge i386 proftpd packages released in DSA 795-1. A new build, 1.2.10-15sarge1.0.1, has been prepared to correct this error. The packages for other architectures are unaffected.

Original Source

Url : http://www.debian.org/security/2005/dsa-795

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 37

OpenVAS Exploits

Date Description
2008-09-24 Name : Gentoo Security Advisory GLSA 200508-02 (proftpd)
File : nvt/glsa_200508_02.nasl
2008-09-04 Name : FreeBSD Ports: proftpd, proftpd-mysql
File : nvt/freebsd_proftpd1.nasl
2008-01-17 Name : Debian Security Advisory DSA 795-2 (proftpd)
File : nvt/deb_795_2.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
18271 ProFTPD mod_sql SQLShowInfo Directive Format String

ProFTPD contains a flaw that may allow a malicious user to modify memory buffers. The issue is triggered if the configuration uses the SQLShowInfo directive provided by mod_sql. This directive can be used to add information from the SQL tables to response messages sent to the client. If misconfigured (by using data from tables into which a user can insert arbitrary strings), data pulled from the SQL tables could be used in such a way as to attempt to use a malicious format string in the returned message to execute arbitrary code.
18270 ProFTPD ftpshut Shutdown Message Format String

ProFTPD contains a flaw that may allow a malicious user to modify memory buffers. The issue is triggered when the %C, %R, and %U variables are used in the shutdown message configuration (ftpshut). A rogue user, if allowed to create directories, can name one in such a way that the %C option will print data in memory buffers. The two other options which might be vulnerable to the same abuse are user name, and remote host name.

Nessus® Vulnerability Scanner

Date Description
2006-05-13 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_c28f4705043f11dabc080001020eed82.nasl - Type : ACT_GATHER_INFO
2005-10-05 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2005-140.nasl - Type : ACT_GATHER_INFO
2005-09-06 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-795.nasl - Type : ACT_GATHER_INFO
2005-08-02 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200508-02.nasl - Type : ACT_GATHER_INFO
2005-07-27 Name : The remote FTP server is affected by multiple vulnerabilities.
File : proftpd_1_3_0_rc2.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:34:17
  • Multiple Updates