oss-security - Re: CVE request for proftpd

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 11 Feb 2009 12:16:02 -0700
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request for proftpd

* [2009-02-11 10:58:05 -0800] TJ Saunders wrote:

>> An SQL injection vulnerability in proftpd was reported on bugtraq
>> yesterday that could allow a user to login to proftpd with any password
>> if they use mysql for authentication (and, presumably, postgresql).
>> 
>> References:
>> 
>> http://www.securityfocus.com/archive/1/500823/30/0/threaded
>> http://bugs.gentoo.org/show_bug.cgi?id=258450
>> http://bugs.proftpd.org/show_bug.cgi?id=3180
>> https://bugzilla.redhat.com/show_bug.cgi?id=485125
>
>This has been reported on the ProFTPD Bugzilla:
>
>  http://bugs.proftpd.org/show_bug.cgi?id=3180
>
>As discussed there, this is a duplicate of an earlier bug:
>
>  http://bugs.proftpd.org/show_bug.cgi?id=3124
>
>and has been fixed in ProFTPD 1.3.2rc3 and later.

Oh, forgot to ask.  It looks like this would have been introduced in
1.3.1.  Is that correct?  So the affected versions would be
1.3.1 to 1.3.2rc2.

Also, as I was looking at the Gentoo report, I noticed bug #3173 which
likely also needs a CVE name (for the "encoding-dependent SQL injection
vulnerability").

Thanks.

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.