[UNIX] ProFTPd Format String Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  ProFTPd Format String Vulnerabilities
------------------------------------------------------------------------


SUMMARY

 <http://www.proftpd.org/> ProFTPD is "a configurable GPL-licensed FTP 
server software".

Under very specific circumstances, ProFTPD is vulnerable to format string 
vulnerabilities, potentially resulting in the execution of arbitrary code.

DETAILS

Vulnerable Systems:
 * ProFTPd version 1.3.0rc1 and prior

Immune Systems:
 * ProFTPd version 1.3.0rc2

ProFTPD is vulnerable to format string vulnerabilities when displaying a 
shutdown message containing the name of the current directory, and when 
displaying response messages to the client using information retrieved 
from a database using mod_sql.

A remote attacker could create a directory with a malicious name that 
would trigger the format string issue if specific variables are used in 
the shutdown message, potentially resulting in a Denial of Service or the 
execution of arbitrary code with the rights of the user running the 
ProFTPD server. An attacker with control over the database contents could 
achieve the same result by introducing malicious messages that would 
trigger the other format string issue when used in server responses.

Workaround:
Do not use the "%C", "%R", or "%U" in shutdown messages, and do not set 
the "SQLShowInfo" directive.

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2390> 
CAN-2005-2390


ADDITIONAL INFORMATION

The information has been provided by  <mailto:jaervosz@xxxxxxxxxx> Sune 
Kloppenborg Jeppesen .
The original article can be found at:  
<http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml> 
http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.