Joined: 13 Jun 2003
Location: Dresden, Germany
|Posted: Wed May 19, 2004 5:17 pm Post subject: [ GLSA 200405-09 ] ProFTPD Access Control List bypass vulner
|Gentoo Linux Security Advisory
Title: ProFTPD Access Control List bypass vulnerability (GLSA 200405-09)
Date: May 19, 2004
Version 1.2.9 of ProFTPD introduced a vulnerability that causes CIDR-based Access Control Lists (ACLs) to be treated as "AllowAll", thereby allowing remote users full access to files available to the FTP daemon.
ProFTPD is an FTP daemon.
Vulnerable: = 1.2.9-r1
Vulnerable: = 1.2.9
Unaffected: >= 1.2.9-r2
Architectures: All supported architectures
ProFTPD 1.2.9 introduced a vulnerability that allows CIDR-based ACLs (such as 10.0.0.1/24) to be bypassed. The CIDR ACLs are disregarded, with the net effect being similar to an "AllowAll" directive.
This vulnerability may allow unauthorized files, including critical system files to be downloaded and/or modified, thereby allowing a potential remote compromise of the server.
Users may work around the problem by avoiding use of CIDR-based ACLs.
ProFTPD users are encouraged to upgrade to the latest version of the package:
|# emerge sync
# emerge -pv ">=net-ftp/proftpd-1.2.9-r2"
# emerge ">=net-ftp/proftpd-1.2.9-r2"
Last edited by GLSA on Sun May 07, 2006 4:51 pm; edited 1 time in total