Joined: 12 May 2004
|Posted: Fri Aug 16, 2019 2:26 am Post subject: [ GLSA 201908-16 ] ProFTPD
|Gentoo Linux Security Advisory
Title: ProFTPD: Remote code execution (GLSA 201908-16)
A vulnerability in ProFTPD could result in the arbitrary execution
ProFTPD is an advanced and very configurable FTP server.
Vulnerable: < 1.3.6-r5
Unaffected: >= 1.3.6-r5
Architectures: All supported architectures
It was discovered that ProFTPD’s “mod_copy” module does not
properly restrict privileges for anonymous users.
A remote attacker, by anonymously uploading a malicious file, could
possibly execute arbitrary code with the privileges of the process, cause
a Denial of Service condition or disclose information.
There is no known workaround at this time.
All ProFTPD users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-ftp/proftpd-1.3.6-r5"