GLSA-201908-16 : ProFTPD: Remote code execution

The remote host is affected by the vulnerability described in GLSA-201908-16 ProFTPD: Remote code execution It was discovered that ProFTPDs modcopy module does not properly restrict privileges for anonymous users. Impact : A remote attacker, by anonymously uploading a malicious file, could possib...

ProFTPD: Remote code execution

Background ProFTPD is an advanced and very configurable FTP server. Description It was discovered that ProFTPD’s “modcopy” module does not properly restrict privileges for anonymous users. Impact A remote attacker, by anonymously uploading a malicious file, could possibly execute arbitrary code...

Fedora 30 : proftpd (2019-e9187610c3)

This update addresses an arbitrary file copy vulnerability in modcopy in ProFTPD, which allowed for remote code execution and information disclosure without authentication due to not honoring constraints. Upstream bug: http://bugs.proftpd.org/showbug.cgi?id=4372 Note that Tenable Network Security...

openSUSE: Security Advisory for proftpd (openSUSE-SU-2019:1836-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

A New 'Arbitrary File Copy' Flaw Affects ProFTPD Powered FTP Servers

A German security researcher has publicly disclosed details of a serious vulnerability in one of the most popular FTP server applications, which is currently being used by more than one million servers worldwide. The vulnerable software in question is ProFTPD , an open source FTP server used by a...

A New 'Arbitrary File Copy' Flaw Affects ProFTPD Powered FTP Servers

A German security researcher has publicly disclosed details of a serious vulnerability in one of the most popular FTP server applications, which is currently being used by more than one million servers worldwide. The vulnerable software in question is ProFTPD, an open source FTP server used by a...

ProFTPD <= 1.3.5b Remote Code Execution

Binary data 701079.prm...

CVE-2019-12815

An arbitrary file copy vulnerability in modcopy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306...

CVE-2019-12815

Summary: CVE-2019-12815 is a vulnerability in ProFTPD’s mod_copy that allowed unauthenticated remote access to copy arbitrary files due to incomplete CPFR/CPTO permission checks, enabling remote code execution and information disclosure. Affected software: ProFTPD up to 1.3.5b (and related 1.3.5 ...

CVE-2019-12815: Improper Handling of Exceptional Conditions

An arbitrary file copy vulnerability in modcopy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306...

Exploit for Improper Access Control in Proftpd

ProFTPd 1.3.5 - modcopy Remote Command Execution ProFTPD i...

ProFTPD mod_copy Information Disclosure

The remote host is running a version of ProFTPD that is affected by an information disclosure vulnerability in the modcopy module due to the SITE CPFR and SITE CPTO commands being available to unauthenticated clients. An unauthenticated, remote attacker can exploit this flaw to read and write to...

openSUSE Security Update : proftpd (openSUSE-2015-410)

The ftp server ProFTPD was updated to 1.3.5a to fix one security issue. The following vulnerability was fixed : - CVE-2015-3306: Unauthenticated copying of files via SITE CPFR/CPTO allowed by modcopy boo927290 In addition, proftpd was updated to 1.3.5a to fix a number of upstream bugs and improve...

ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ProFTPD 1.3.5 ModCopy Command Execution', 'Description' = %q This module exploits the SITE CPFR/CPTO commands in ProFTPD version...

ProFTPD mod_copy command execution

Added: 05/29/2015 CVE: CVE-2015-3306 BID: 74238 OSVDB: 120834 Background ProFTPD is free FTP Server software for Unix and Linux platforms. Problem The modcopy extension, if enabled in ProFTPD, allows unauthenticated attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO...

ProFTPD mod_copy command execution

Added: 05/29/2015 CVE: CVE-2015-3306 BID: 74238 OSVDB: 120834 Background ProFTPD is free FTP Server software for Unix and Linux platforms. Problem The modcopy extension, if enabled in ProFTPD, allows unauthenticated attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO...

ProFTPD mod_copy command execution

Added: 05/29/2015 CVE: CVE-2015-3306 BID: 74238 OSVDB: 120834 Background ProFTPD is free FTP Server software for Unix and Linux platforms. Problem The modcopy extension, if enabled in ProFTPD, allows unauthenticated attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO...

ProFTPD mod_copy command execution

Added: 05/29/2015 CVE: CVE-2015-3306 BID: 74238 OSVDB: 120834 Background ProFTPD is free FTP Server software for Unix and Linux platforms. Problem The modcopy extension, if enabled in ProFTPD, allows unauthenticated attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO...

FreeBSD : proftpd -- arbitrary code execution vulnerability with chroot (d0034536-ff24-11e4-a072-d050996490d0)

ProFTPd development team reports : Vadim Melihow reported a critical issue with proftpd installations that use the modcopy module's SITE CPFR/SITE CPTO commands; modcopy allows these commands to be used by unauthenticated clients. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Debian DSA-3263-1 : proftpd-dfsg - security update

Vadim Melihow discovered that in proftpd-dfsg, an FTP server, the modcopy module allowed unauthenticated users to copy files around on the server, and possibly to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...