CVE-2001-0456

Summary: CVE-2001-0456 affects ProFTPD in Debian 2.2 where the postinst script fails to properly adjust the “run as uid/gid root” setting when anonymous access is enabled, causing the server to run with elevated privileges. What’s affected: proftpd on Debian 2.2 (potato); issue in post-install co...

CVE-2001-0136

ProFTPD 1.2.0rc2 is affected by a memory leak that can be exploited to cause DoS via a sequence of USER commands and, if the server is installed with a writable scoreboard, possibly SIZE commands. Mandrake advisory notes the USER and SIZE leaks (SIZE only when scoreboard is writable) and mentions...

CVE-2001-0136

Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER commands, and possibly SIZE commands if the server has been improperly installed...

CVE-2001-0456

postinst installation script for Proftpd in Debian 2.2 does not properly change the "run as uid/gid root" configuration when the user enables anonymous access, which causes the server to run at a higher privilege than intended...

CVE-1999-1475

CVE-1999-1475 covers ProFTPd 1.2 compiled with the mod_sqlpw module, where passwords are recorded in the wtmp log file. This allows a local user to read passwords (e.g., via the last command) and potentially obtain privileges. Root cause: unintended password exposure via wtmp logging. Exploitatio...

CVE-1999-1475

ProFTPd 1.2 compiled with the modsqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command...

CVE-2001-0456

postinst installation script for Proftpd in Debian 2.2 does not properly change the "run as uid/gid root" configuration when the user enables anonymous access, which causes the server to run at a higher privilege than intended...

CVE-2001-0318

Format string vulnerability in ProFTPD 1.2.0rc2 may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory cwd...

CVE-2001-0318

CVE-2001-0318 corresponds to a format-string vulnerability in ProFTPD 1.2.0rc2 that could allow an attacker to execute arbitrary commands by shutting down the FTP server while a malformed working directory (cwd) is in use. The vulnerability is remote and unauthenticated per the CVSS data, with At...

CVE-2001-0318

Format string vulnerability in ProFTPD 1.2.0rc2 may allow attackers to execute arbitrary commands by shutting down the FTP server while using a malformed working directory cwd...

Multiple vendors FTP denial of service

Proftpd built-in 'ls' command has a globbing bug that allows remote denial-of-service. Here's a simple exploit, tested on the Proftpd site : $ ftp ftp.proftpd.org ... Name ftp.proftpd.org:j: ftp ... 230 Anonymous access granted, restrictions apply. Remote system type is UNIX. Using binary mode to...

ProFTPD STAT Command Remote DoS

The remote FTP server is affected by a denial of service vulnerability that is triggered when it receives a specially crafted STAT command. A remote attacker can exploit this to cause the consumption of all available memory. C Tenable Network Security, Inc. Script audit and contributions from...

CVE-2001-0136

Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER commands, and possibly SIZE commands if the server has been improperly installed...

[SECURITY] [DSA-032-2] proftp runs as root, /var symlink removal

Package: proftpd Vulnerability: proftpd running as root, /var symlink removal Debian-specific: yes This is an update to the DSA-032-1 advisory. The powerpc package that was listed in that advisory was unfortunately compiled on the wrong system which caused it to not work on a Debian GNU/Linux 2.2...

[SECURITY] [DSA-032-1] proftp runs as root, /var symlink removal

Package: proftpd Vulnerability: proftpd running as root, /var symlink removal Debian-specific: yes The following problems have been reported for the version of proftpd in Debian 2.2 potato: 1. There is a configuration error in the postinst script, when the user enters yes, when asked if anonymous...

[SECURITY] [DSA 029-2] New proftpd packages for m68k available

---------------------------------------------------------------------------- Debian Security Advisory DSA-029-2 [email protected] http://www.debian.org/security/ Martin Schulze March 6, 2001 - ---------------------------------------------------------------------------- Package : proftpd...

CVE-2001-0027

modsqlpw module in ProFTPD does not reset a cached password when a user uses the "user" command to change accounts, which allows authenticated attackers to gain privileges of other users...

[SECURITY] [DSA-029-1] New version of proftpd released

Package: proftpd Vulnerability: remote DOS & potential buffer overflow Debian-specific: no The following problems have been reported for the version of proftpd in Debian 2.2 potato: 1. There is a memory leak in the SIZE command which can result in a denial of service, as reported by Wojciech...

Закрыты дырки в ProFTPD

3 различных удаленных дырки...

Response to ProFTPD issues

======= Summary ======= Three issues with the ProFTPD FTP server have been reported to BUGTRAQ in the past month. These issues have been addressed by the ProFTPD core team. The following vulnerabilities are addressed in this advisory: 1. "SIZE memory leak"...