7.5 - MDVSA-2009:061

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	MDVSA-2009:061	First vendor Publication	2009-02-27
Vendor	Mandriva	Last vendor Modification	2009-02-27
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2009:061

CWE : Common Weakness Enumeration

%	Id	Name
67 %	CWE-89	Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25)
33 %	CWE-352	Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12886

Oval ID:	oval:org.mitre.oval:def:12886
Title:	DSA-1727-1 proftpd-dfsg -- SQL injection vulnerabilites
Description:	Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0542 Shino discovered that proftpd is prone to an SQL injection vulnerability via the use of certain characters in the username. CVE-2009-0543 TJ Saunders discovered that proftpd is prone to an SQL injection vulnerability due to insufficient escaping mechanisms, when multybite character encodings are used. For the stable distribution, these problems have been fixed in version 1.3.1-17lenny1. For the oldstable distribution, these problems will be fixed soon. For the testing distribution, these problems will be fixed soon. For the unstable distribution, these problems have been fixed in version 1.3.2-1. We recommend that you upgrade your proftpd-dfsg package.
Family:	unix	Class:	patch
Reference(s):	DSA-1727-1 CVE-2009-0542 CVE-2009-0543	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd DPKG is earlier than 1.3.1-17lenny1 AND proftpd-doc DPKG is earlier than 1.3.1-17lenny1 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is mips AND Installed architecture is mipsel AND Installed architecture is arm AND Packages section proftpd-mod-mysql DPKG is earlier than 1.3.1-17lenny1 AND proftpd-mod-pgsql DPKG is earlier than 1.3.1-17lenny1 AND proftpd-mod-ldap DPKG is earlier than 1.3.1-17lenny1 AND proftpd-basic DPKG is earlier than 1.3.1-17lenny1

Definition Id: oval:org.mitre.oval:def:13553

Oval ID:	oval:org.mitre.oval:def:13553
Title:	DSA-1730-1 proftpd-dfsg -- SQL injection vulnerabilites
Description:	The security update for proftpd-dfsg in DSA-1727-1 caused a regression with the postgresql backend. This update corrects the flaw. Also it was discovered that the oldstable distribution is not affected by the security issues. For reference the original advisory follows. Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0542 Shino discovered that proftpd is prone to an SQL injection vulnerability via the use of certain characters in the username. CVE-2009-0543 TJ Saunders discovered that proftpd is prone to an SQL injection vulnerability due to insufficient escaping mechanisms, when multybite character encodings are used. For the stable distribution, these problems have been fixed in version 1.3.1-17lenny2. The oldstable distribution is not affected by these problems. For the unstable distribution, these problems have been fixed in version 1.3.2-1. For the testing distribution, these problems will be fixed soon.
Family:	unix	Class:	patch
Reference(s):	DSA-1730-1 CVE-2009-0542 CVE-2009-0543	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd DPKG is earlier than 1.3.1-17lenny2 AND proftpd-doc DPKG is earlier than 1.3.1-17lenny2 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is mipsel AND Installed architecture is arm AND Packages section proftpd-mod-mysql DPKG is earlier than 1.3.1-17lenny2 AND proftpd-mod-pgsql DPKG is earlier than 1.3.1-17lenny2 AND proftpd-mod-ldap DPKG is earlier than 1.3.1-17lenny2 AND proftpd-basic DPKG is earlier than 1.3.1-17lenny2

Definition Id: oval:org.mitre.oval:def:20068

Oval ID:	oval:org.mitre.oval:def:20068
Title:	DSA-1689-1 proftpd-dfsg - Cross-Site Request Forgery
Description:	Maksymilian Arciemowicz of securityreason.com reported that ProFTPD is vulnerable to cross-site request forgery (CSRF) attacks and executes arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
Family:	unix	Class:	patch
Reference(s):	DSA-1689-1 CVE-2008-4242	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND proftpd-dfsg DPKG is earlier than 0:1.3.0-19etch2

Definition Id: oval:org.mitre.oval:def:7391

Oval ID:	oval:org.mitre.oval:def:7391
Title:	DSA-1730 proftpd-dfsg -- SQL injection vulnerabilities
Description:	The security update for proftpd-dfsg in DSA-1727-1 caused a regression with the postgresql backend. This update corrects the flaw. Also it was discovered that the oldstable distribution (etch) is not affected by the security issues. For reference the original advisory follows. Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: Shino discovered that proftpd is prone to an SQL injection vulnerability via the use of certain characters in the username. TJ Saunders discovered that proftpd is prone to an SQL injection vulnerability due to insufficient escaping mechanisms, when multybite character encodings are used. The oldstable distribution (etch) is not affected by these problems.
Family:	unix	Class:	patch
Reference(s):	DSA-1730 CVE-2009-0542 CVE-2009-0543	Version:	4
Platform(s):	Debian GNU/Linux 5.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd is earlier than 1.3.1-17lenny2 AND proftpd-doc is earlier than 1.3.1-17lenny2 AND proftpd-mod-mysql is earlier than 1.3.1-17lenny2 AND proftpd-mod-pgsql is earlier than 1.3.1-17lenny2 AND proftpd-mod-ldap is earlier than 1.3.1-17lenny2 AND proftpd-basic is earlier than 1.3.1-17lenny2

Definition Id: oval:org.mitre.oval:def:7948

Oval ID:	oval:org.mitre.oval:def:7948
Title:	DSA-1689 proftpd-dfsg -- missing input validation
Description:	Maksymilian Arciemowicz of securityreason.com reported that ProFTPD is vulnerable to cross-site request forgery (CSRF) attacks and executes arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
Family:	unix	Class:	patch
Reference(s):	DSA-1689 CVE-2008-4242	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd-pgsql is earlier than 1.3.0-19etch2 AND proftpd-doc is earlier than 1.3.0-19etch2 AND proftpd-mysql is earlier than 1.3.0-19etch2 AND proftpd-ldap is earlier than 1.3.0-19etch2 AND proftpd is earlier than 1.3.0-19etch2

Definition Id: oval:org.mitre.oval:def:7963

Oval ID:	oval:org.mitre.oval:def:7963
Title:	DSA-1727 proftpd-dfsg -- SQL injection vulnerabilities
Description:	Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems: Shino discovered that proftpd is prone to an SQL injection vulnerability via the use of certain characters in the username. TJ Saunders discovered that proftpd is prone to an SQL injection vulnerability due to insufficient escaping mechanisms, when multybite character encodings are used.
Family:	unix	Class:	patch
Reference(s):	DSA-1727 CVE-2009-0542 CVE-2009-0543	Version:	3
Platform(s):	Debian GNU/Linux 5.0	Product(s):	proftpd-dfsg
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND Packages section proftpd is earlier than 1.3.1-17lenny1 AND proftpd-doc is earlier than 1.3.1-17lenny1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is mips AND Installed architecture is mipsel AND Installed architecture is arm AND Packages section proftpd-mod-mysql is earlier than 1.3.1-17lenny1 AND proftpd-mod-pgsql is earlier than 1.3.1-17lenny1 AND proftpd-mod-ldap is earlier than 1.3.1-17lenny1 AND proftpd-basic is earlier than 1.3.1-17lenny1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Proftpd cpe:2.3:a:proftpd:proftpd:1.3.1:::::::*	1
Application	Proftpd Project Proftpd cpe:2.3:a:proftpd_project:proftpd:1.3.2_rc2:::::::* cpe:2.3:a:proftpd_project:proftpd:1.3.2:::::::* cpe:2.3:a:proftpd_project:proftpd:1.3.1:::::::*	3

OpenVAS Exploits

Date	Description
2009-09-28	Name : Fedora Core 10 FEDORA-2009-9386 (proftpd) File : nvt/fcore_2009_9386.nasl
2009-06-05	Name : Ubuntu USN-723-1 (git-core) File : nvt/ubuntu_723_1.nasl
2009-06-05	Name : Ubuntu USN-698-1 (nagios) File : nvt/ubuntu_698_1.nasl
2009-03-20	Name : FreeBSD Ports: proftpd, proftpd-mysql File : nvt/freebsd_proftpd5.nasl
2009-03-20	Name : Debian Security Advisory DSA 1727-1 (proftpd-dfsg) File : nvt/deb_1727_1.nasl
2009-03-13	Name : Gentoo Security Advisory GLSA 200903-27 (proftpd) File : nvt/glsa_200903_27.nasl
2009-03-07	Name : Debian Security Advisory DSA 1730-1 (proftpd-dfsg) File : nvt/deb_1730_1.nasl
2009-02-20	Name : ProFTPD Server SQL Injection Vulnerability File : nvt/secpod_proftpd_server_sql_inj_vuln.nasl
2009-01-07	Name : Fedora Core 10 FEDORA-2009-0089 (proftpd) File : nvt/fcore_2009_0089.nasl
2009-01-07	Name : Fedora Core 8 FEDORA-2009-0195 (proftpd) File : nvt/fcore_2009_0195.nasl
2009-01-07	Name : Fedora Core 9 FEDORA-2009-0064 (proftpd) File : nvt/fcore_2009_0064.nasl
2008-12-29	Name : Debian Security Advisory DSA 1689-1 (proftpd-dfsg) File : nvt/deb_1689_1.nasl
2008-12-29	Name : Ubuntu USN-697-1 (imlib2) File : nvt/ubuntu_697_1.nasl
2008-12-29	Name : Ubuntu USN-698-2 (nagios3) File : nvt/ubuntu_698_2.nasl
2008-12-29	Name : Ubuntu USN-699-1 (blender) File : nvt/ubuntu_699_1.nasl
2008-09-26	Name : ProFTPD Long Command Handling Security Vulnerability File : nvt/secpod_proftpd_cmd_handling_sec_vuln_900133.nasl
2008-09-24	Name : FreeBSD Ports: proftpd, proftpd-mysql File : nvt/freebsd_proftpd4.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
51954	ProFTPD Server NLS Support mod_sql_* Encoded Multibyte Character SQL Injectio...
51953	ProFTPD Server mod_sql username % Character Handling SQL Injection
51849	ProFTPD Character Encoding SQL Injection ProFTPD contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to an unspecified function not properly sanitizing user-supplied input to the username and password parameters. This may allow an attacker to inject or manipulate SQL queries in the back-end database.
48411	ProFTPD FTP Command Truncation CSRF

Snort® IPS/IDS

Date	Description
2014-01-10	ProFTPD username sql injection attempt RuleID : 16524 - Revision : 10 - Type : PROTOCOL-FTP

Nessus® Vulnerability Scanner

Date	Description
2010-12-23	Name : The remote FTP server is affected by a heap-based buffer overflow vulnerability. File : proftpd_1_3_3d.nasl - Type : ACT_GATHER_INFO
2009-09-25	Name : The remote Fedora host is missing a security update. File : fedora_2009-9386.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Fedora host is missing a security update. File : fedora_2009-0089.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-061.nasl - Type : ACT_GATHER_INFO
2009-03-17	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_ca0841ff125411dea9640030843d3802.nasl - Type : ACT_GATHER_INFO
2009-03-13	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200903-27.nasl - Type : ACT_GATHER_INFO
2009-03-03	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1730.nasl - Type : ACT_GATHER_INFO
2009-02-26	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1727.nasl - Type : ACT_GATHER_INFO
2009-02-17	Name : The remote FTP server is affected by a SQL injection vulnerability. File : proftpd_user_sql_injection.nasl - Type : ACT_ATTACK
2009-01-16	Name : The remote Fedora host is missing a security update. File : fedora_2009-0064.nasl - Type : ACT_GATHER_INFO
2009-01-16	Name : The remote Fedora host is missing a security update. File : fedora_2009-0195.nasl - Type : ACT_GATHER_INFO
2008-12-22	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1689.nasl - Type : ACT_GATHER_INFO
2008-09-23	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_0f51f2c9895611dda6fe0030843d3802.nasl - Type : ACT_GATHER_INFO
2008-09-23	Name : The remote FTP server is prone to a cross-site request forgery attack. File : proftpd_cmd_truncation_csrf.nasl - Type : ACT_ATTACK

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:40:05	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	3
Oval ID(s)	6
CPE ID(s)	4
osvdb(s)	4
Openvas Exploit(s)	17
Snort® Rule(s)	1
Nessus® Exploit(s)	14

	Related
7.5	CVE-2009-0542
6.8	CVE-2009-0543
6.8	CVE-2008-4242
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0593s

Facebook rss twitter linkedin mail