Bug 485125 - (CVE-2009-0542) CVE-2009-0542 proftpd: SQL injection during login
CVE-2009-0542 proftpd: SQL injection during login
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
urgent Severity urgent
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 485129 485130 485131
  Show dependency treegraph
Reported: 2009-02-11 13:28 EST by Vincent Danen
Modified: 2010-03-29 05:26 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2010-03-29 05:26:12 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
exploit for this proftpd issue, from bugtraq (2.78 KB, application/x-perl)
2009-02-11 13:37 EST, Vincent Danen
no flags Details

  None (edit)
Description Vincent Danen 2009-02-11 13:28:15 EST
An SQL injection vulnerability was reported on bugtraq that could allow a user to login with any password.


Gentoo BTS: http://bugs.gentoo.org/show_bug.cgi?id=258450

Bugtraq initial post: http://www.securityfocus.com/archive/1/500823/30/0/threaded
Comment 1 Vincent Danen 2009-02-11 13:33:00 EST
The upstream bug is here:  http://bugs.proftpd.org/show_bug.cgi?id=3180
Comment 2 Vincent Danen 2009-02-11 13:37:43 EST
Created attachment 331600 [details]
exploit for this proftpd issue, from bugtraq

This comes from bugtraq: http://www.securityfocus.com/archive/1/500851/30/0/threaded
Comment 3 Vincent Danen 2009-02-11 13:59:36 EST
Created Fedora tracking bugs for proftpd:

9: bug #485129
10: bug #485130
rawhide: bug #485131
Comment 4 Vincent Danen 2009-02-11 14:08:26 EST
This is fixed in proftpd 1.3.2 and seems to only affect 1.3.1.  The upstream bug with this fix is http://bugs.proftpd.org/show_bug.cgi?id=3124.
Comment 5 Vincent Danen 2009-02-11 16:18:06 EST
The gentoo BTS also refers to a similar SQL-ish issue, which is upstream bug http://bugs.proftpd.org/show_bug.cgi?id=3173.  That issue, however, does not affect us as it only affects protftpd installs with NLS support enabled, which we do not enable (and the default in ./configure is disabled).

Noting this here as the gentoo BTS mentions both issues in the report, but only the one noted above actually affects us (although if Fedora updates to 1.3.2, this will be dealt with at the same time).
Comment 6 Vincent Danen 2009-02-12 11:14:10 EST
This issue has been assigned CVE-2009-0542.  The second issue that doesn't affect us has been assigned CVE-2009-0543 (just noting it here for reference).
Comment 7 Fedora Update System 2009-08-03 11:32:45 EDT
proftpd-1.3.2a-2.fc10 has been submitted as an update for Fedora 10.
Comment 8 Fedora Update System 2009-08-19 18:50:46 EDT
proftpd-1.3.2a-3.fc10 has been submitted as an update for Fedora 10.
Comment 9 Fedora Update System 2009-09-02 07:12:10 EDT
proftpd-1.3.2a-4.fc10 has been submitted as an update for Fedora 10.
Comment 10 Fedora Update System 2009-09-07 11:08:12 EDT
proftpd-1.3.2a-5.fc10 has been submitted as an update for Fedora 10.
Comment 11 Fedora Update System 2009-09-24 01:25:38 EDT
proftpd-1.3.2a-5.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.