|
|
Family: Debian Local Security Checks --> Category: infos
[DSA795] DSA-795-2 proftpd Vulnerability Scan
Vulnerability Scan Summary
DSA-795-2 proftpd
Detailed Explanation for this Vulnerability Test
infamous42md reported that proftpd suffers from two format string
vulnerabilities. In the first, a user with the ability to create a
directory could trigger the format string error if there is a
proftpd shutdown message configured to use the "%C", "%R", or "%U"
variables. In the second, the error is triggered if mod_sql is used
to retrieve messages from a database and if format strings have been
inserted into the database by a user with permission to do so.
The old stable distribution (woody) is not affected by these
vulnerabilities.
For the stable distribution (sarge) this problem has been fixed in
version 1.2.10-15sarge1. There was an error in the packages originally
prepared for i386, which was corrected in 1.2.10-15sarge1.0.1 for i386.
For the unstable distribution (sid) this problem has been fixed in
version 1.2.10-20.
We recommend that you upgrade your proftpd package.
Solution : http://www.debian.org/security/2005/dsa-795
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
