Vulnerability in proftpd package
Summary
DSA-1222-1: proftpd. Affects proftpd versions < 1.2.10-15sarge3. Fixed in 1.2.10-15sarge3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The proftpd package is an FTP daemon used for file transfer between client and server. It provides a secure and efficient way to transfer files over the network. The package is widely used in various Linux distributions, including Debian. However, a vulnerability has been discovered in the proftpd package that could allow remote attackers to execute arbitrary code or cause denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2006-5815, is caused by a buffer overflow in the sreplace() function of proftpd. This buffer overflow can be exploited by an attacker to crash the FTP daemon or potentially execute arbitrary code. Another vulnerability, CVE-2006-6170, is also present in the mod_tls addon module, which can lead to the execution of arbitrary code. Insufficient validation of FTP command buffer size limits, identified as CVE-2006-6171, can result in denial of service attacks. These vulnerabilities pose a significant risk to systems running the affected proftpd package.
How To Fix
Minimum fixed version
1.2.10-15sarge3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade proftpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The proftpd package has been found to have vulnerabilities that can be exploited by remote attackers. It is crucial to upgrade to the latest version or apply the provided patches to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for proftpd →
FAQ
Proftpd is an FTP daemon used for file transfer between client and server. It provides a secure and efficient way to transfer files over the network.
The vulnerabilities in proftpd include a buffer overflow in the sreplace() function, a buffer overflow in the mod_tls addon module, and insufficient validation of FTP command buffer size limits.
These vulnerabilities can allow remote attackers to execute arbitrary code or cause denial of service on systems running the affected proftpd package.
To fix these vulnerabilities, it is recommended to upgrade the proftpd package to the latest version available for your distribution.
At the moment, there is no known workaround for these vulnerabilities. It is recommended to apply the available patches or upgrade to the latest version of the proftpd package.
Related vulnerabilities
Recent vulnerabilities recorded for proftpd.
