proftpd -- vulnerability in mod_tls

MITRE reports: The modtls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman DH key to be used and consequently allow attackers to have unspecified impact via unknown vectors...

[Backports-security-announce] Security Update for proftpd-dfsg

Francesco P. Lovergine uploaded new packages for proftpd-dfsg which fixed the following security problem: CVE-2009-3639 The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a \0 character in a domain name i...

[Backports-security-announce] Security Update for proftpd-dfsg

Francesco P. Lovergine uploaded new packages for proftpd-dfsg which fixed the following security problem: CVE-2009-3639 The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a \0 character in a domain name i...

[Backports-security-announce] Security Update for proftpd-dfsg

Francesco P. Lovergine uploaded new packages for proftpd-dfsg which fixed the following security problem: CVE-2009-3639 The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a \0 character in a domain name i...

Fedora 10 : proftpd-1.3.2b-1.fc10 (2009-11666)

This update fixes CVE-2009-3639, in which proftpd's modtls, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate. This allows remote attackers to bypass intended...

CVE-2009-3639

The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended...

Design/Logic Flaw

The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended...

CVE-2009-3639

The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended...

CVE-2009-3639

Technical details about CVE-2009-3639 are not provided in the connected documents; no affected products, versions, or fixes are specified here. Monitor for updates.

CVE-2009-3639

The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended...

CVE-2009-3639

The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended...

ProFTPD mod_tls模块CA SSL证书验证漏洞

BUGTRAQ ID: 36804 CVE ID: CVE-2009-3639 ProFTPD是一款开放源代码FTP服务程序。 ProFTPD的modtls模块没有正确地处理X.509证书主题通用名称（CN）字段域名中的空字符（\0），在处理包含有空字符的证书字段时错误地将空字符处理为截止字符，因此只会验证空字符前的部分。例如，对于类似于以下的名称： example.com\0.haxx.se 证书是发布给haxx.se的，但modtls模块错误的验证给example.com，这有助于攻击者通过中间人攻击执行网络钓鱼等欺骗。 必须满足以下modtls配置的情况下服务器才受这个漏洞影响：...

Mandrake Security Advisory MDVSA-2009:288 (proftpd)

The remote host is missing an update to proftpd announced via advisory MDVSA-2009:288. OpenVAS Vulnerability Test $Id: mdksa2009288.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:288 proftpd Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Mandrake Security Advisory MDVSA-2009:288 (proftpd)

The remote host is missing an update to proftpd announced via advisory MDVSA-2009:288. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

ProFTPD < 1.3.2b, 1.3.3 - 1.3.3.rc1 SSL Certificate Validation Bypass Vulnerability

ProFTPD is prone to a security bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might b...

Mandriva Linux Security Advisory : proftpd (MDVSA-2009:288)

A vulnerability has been identified and corrected in proftpd : The modtls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '' character in a domain name in the Subject Alternative Name field of an X.509 client...

Mandriva Update for proftpd MDKA-2007:089 (proftpd)

Check for the Version of proftpd OpenVAS Vulnerability Test Mandriva Update for proftpd MDKA-2007:089 proftpd Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Debian Security Advisory DSA 1222-1 (proftpd)

The remote host is missing an update to proftpd announced via advisory DSA 1222-1. Several remote vulnerabilities have been discovered in the proftpd FTP daemon, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the...

Debian Security Advisory DSA 1222-1 (proftpd)

The remote host is missing an update to proftpd announced via advisory DSA 1222-1. Several remote vulnerabilities have been discovered in the proftpd FTP daemon, which may lead to the execution of arbitrary code or denial of service. The Common Vulnerabilities and Exposures project identifies the...

Debian Security Advisory DSA 1222-2 (proftpd)

The remote host is missing an update to proftpd announced via advisory DSA 1222-2. Due to technical problems yesterday's proftpd update lacked a build for the amd64 architecture, which is now available. Several remote vulnerabilities have been discovered in the proftpd FTP daemon, which may lead ...