Date: Wed, 11 Feb 2009 12:13:42 -0700 From: Vincent Danen <vdanen@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE request for proftpd * [2009-02-11 10:58:05 -0800] TJ Saunders wrote: >> An SQL injection vulnerability in proftpd was reported on bugtraq >> yesterday that could allow a user to login to proftpd with any password >> if they use mysql for authentication (and, presumably, postgresql). >> >> References: >> >> http://www.securityfocus.com/archive/1/500823/30/0/threaded >> http://bugs.gentoo.org/show_bug.cgi?id=258450 >> http://bugs.proftpd.org/show_bug.cgi?id=3180 >> https://bugzilla.redhat.com/show_bug.cgi?id=485125 > >This has been reported on the ProFTPD Bugzilla: > > http://bugs.proftpd.org/show_bug.cgi?id=3180 Yeah, I noted that above. =) >As discussed there, this is a duplicate of an earlier bug: > > http://bugs.proftpd.org/show_bug.cgi?id=3124 > >and has been fixed in ProFTPD 1.3.2rc3 and later. Thanks, TJ. I just read the comments and the duplicate note a few minutes ago and was going to reply to it. We still need a CVE name, however. Bug #3124 does not note any kind of security impact, which there clearly is, so I don't believe a CVE name had been assigned to this previously (at least not that I could find). -- Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.