[UNIX] ProFTPd Format String Vulnerabilities

From: SecuriTeam (support_at_securiteam.com)
Date: 08/02/05

  • Next message: SecuriTeam: "[NT] GXT Editor Buffer Overflow" 
    To: list@securiteam.com
Date: 2 Aug 2005 18:01:32 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      ProFTPd Format String Vulnerabilities
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.proftpd.org/> ProFTPD is "a configurable GPL-licensed FTP
    server software".

    Under very specific circumstances, ProFTPD is vulnerable to format string
    vulnerabilities, potentially resulting in the execution of arbitrary code.

    DETAILS

    Vulnerable Systems:
     * ProFTPd version 1.3.0rc1 and prior

    Immune Systems:
     * ProFTPd version 1.3.0rc2

    ProFTPD is vulnerable to format string vulnerabilities when displaying a
    shutdown message containing the name of the current directory, and when
    displaying response messages to the client using information retrieved
    from a database using mod_sql.

    A remote attacker could create a directory with a malicious name that
    would trigger the format string issue if specific variables are used in
    the shutdown message, potentially resulting in a Denial of Service or the
    execution of arbitrary code with the rights of the user running the
    ProFTPD server. An attacker with control over the database contents could
    achieve the same result by introducing malicious messages that would
    trigger the other format string issue when used in server responses.

    Workaround:
    Do not use the "%C", "%R", or "%U" in shutdown messages, and do not set
    the "SQLShowInfo" directive.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2390>
    CAN-2005-2390

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:jaervosz@gentoo.org> Sune
    Kloppenborg Jeppesen .
    The original article can be found at:
    <http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml>
    http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] GXT Editor Buffer Overflow"

    Relevant Pages

    • [UNIX] ProFTPD ASCII File Remote Compromise Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ISS X-Force has discovered a flaw in the ProFTPD UNIX FTP server. ... remote attackers when transferring files from the FTP server in ASCII ... and then attempt to download the same file to trigger the vulnerability. ...
      (Securiteam)
    • [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile, ...
      (Securiteam)
    • [NT] Novell eDirectory Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Multiple Vulnerabilities ... Three different vulnerabilities were discovered in Novell's eDirectory ... NCP over IP length Heap Overflow: ...
      (Securiteam)
    • [NEWS] Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities ...
      (Securiteam)
    • [UNIX] Apache HTTPD suEXEC Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache HTTPD suEXEC Multiple Vulnerabilities ... Local exploitation of multiple vulnerabilities within Apache Software ... Foundation's suexec utility could allow an attacker to execute arbitrary ...
      (Securiteam)