proftpd: Several SQL injection vulnerabilities

Debian Bug report logs - #516388
proftpd: Several SQL injection vulnerabilities

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: proftpd: Several SQL injection vulnerabilities

Date: Sat, 21 Feb 2009 16:21:51 +1100

Package: proftpd
Severity: grave
Tags: security
Justification: user security hole

Hi,
the following CVE (Common Vulnerabilities & Exposures) ids were
published for proftpd.

CVE-2009-0543[0]:
| ProFTPD Server 1.3.1, with NLS support enabled, allows remote
| attackers to bypass SQL injection protection mechanisms via invalid,
| encoded multibyte characters, which are not properly handled in (1)
| mod_sql_mysql and (2) mod_sql_postgres.

CVE-2009-0542[1]:
| SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2
| allows remote attackers to execute arbitrary SQL commands via a "%"
| (percent) character in the username, which introduces a "'" (single
| quote) character during variable substitution by mod_sql.

The postgresql part should still be vulnerable as discussed via
previous mail. The second issue seems to be still unaddressed. It needs
to be investigated, whether upstream's fix is complete, since it doesn't
seem to use the usual escaping functions.

If you fix the vulnerabilities please also make sure to include the
CVE ids in your changelog entry.

Cheers
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0543
    http://security-tracker.debian.net/tracker/CVE-2009-0543
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0542
    http://security-tracker.debian.net/tracker/CVE-2009-0542

Message #10 received at 516388@bugs.debian.org (full text, mbox, reply):

From: Milen Rangelov <gat3way@gat3way.eu>

To: 516388@bugs.debian.org

Subject: proftpd: Several SQL injection vulnerabilities

Date: Tue, 24 Feb 2009 10:58:41 +0200

Since I am the "culprit" that reported the second bug (CVE-2009-0542), I can  
confirm it affects debian's proftpd packages in testing/unstable 
repositories. That's because I discovered it on my debian system.

My proftpd version is 1.3.1-16.

According to the ProFTPD team, the bug is fixed in 1.3.2 rc3 (1.3.2 is not 
vulnerable, 1.3.2 rc1 and rc2 are vulnerable), so upgrading to 1.3.2 should 
fix the issue.

Message #15 received at 516388-done@bugs.debian.org (full text, mbox, reply):

From: "Francesco P. Lovergine" <frankie@debian.org>

To: Milen Rangelov <gat3way@gat3way.eu>, 516388-done@bugs.debian.org

Subject: Re: Bug#516388: proftpd: Several SQL injection vulnerabilities

Date: Tue, 24 Feb 2009 12:26:54 +0100

Package: proftpd-dfsg
Version: 1.3.2-1

Note that 1.3.1-17 also partially fixes CVE-2009-0543. That bug
does not apply to 1.3.0. Next time would be better reporting
separately each issue.

-- 
Francesco P. Lovergine

Send a report that this bug log contains spam.