An SQL injection vulnerability was reported on bugtraq that could allow a user to login with any password. References: Gentoo BTS: http://bugs.gentoo.org/show_bug.cgi?id=258450 Bugtraq initial post: http://www.securityfocus.com/archive/1/500823/30/0/threaded
The upstream bug is here: http://bugs.proftpd.org/show_bug.cgi?id=3180
Created attachment 331600 [details] exploit for this proftpd issue, from bugtraq This comes from bugtraq: http://www.securityfocus.com/archive/1/500851/30/0/threaded
Created Fedora tracking bugs for proftpd: 9: bug #485129 10: bug #485130 rawhide: bug #485131
This is fixed in proftpd 1.3.2 and seems to only affect 1.3.1. The upstream bug with this fix is http://bugs.proftpd.org/show_bug.cgi?id=3124.
The gentoo BTS also refers to a similar SQL-ish issue, which is upstream bug http://bugs.proftpd.org/show_bug.cgi?id=3173. That issue, however, does not affect us as it only affects protftpd installs with NLS support enabled, which we do not enable (and the default in ./configure is disabled). Noting this here as the gentoo BTS mentions both issues in the report, but only the one noted above actually affects us (although if Fedora updates to 1.3.2, this will be dealt with at the same time).
This issue has been assigned CVE-2009-0542. The second issue that doesn't affect us has been assigned CVE-2009-0543 (just noting it here for reference).
proftpd-1.3.2a-2.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/proftpd-1.3.2a-2.fc10
proftpd-1.3.2a-3.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/proftpd-1.3.2a-3.fc10
proftpd-1.3.2a-4.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/proftpd-1.3.2a-4.fc10
proftpd-1.3.2a-5.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/proftpd-1.3.2a-5.fc10
proftpd-1.3.2a-5.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.