[UNIX] ProFTPd Format String Vulnerabilities

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

ProFTPd Format String Vulnerabilities
------------------------------------------------------------------------

SUMMARY

<http://www.proftpd.org/> ProFTPD is "a configurable GPL-licensed FTP
server software".

Under very specific circumstances, ProFTPD is vulnerable to format string
vulnerabilities, potentially resulting in the execution of arbitrary code.

DETAILS

Vulnerable Systems:
* ProFTPd version 1.3.0rc1 and prior

Immune Systems:
* ProFTPd version 1.3.0rc2

ProFTPD is vulnerable to format string vulnerabilities when displaying a
shutdown message containing the name of the current directory, and when
displaying response messages to the client using information retrieved
from a database using mod_sql.

A remote attacker could create a directory with a malicious name that
would trigger the format string issue if specific variables are used in
the shutdown message, potentially resulting in a Denial of Service or the
execution of arbitrary code with the rights of the user running the
ProFTPD server. An attacker with control over the database contents could
achieve the same result by introducing malicious messages that would
trigger the other format string issue when used in server responses.

Workaround:
Do not use the "%C", "%R", or "%U" in shutdown messages, and do not set
the "SQLShowInfo" directive.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2390>
CAN-2005-2390

ADDITIONAL INFORMATION

The information has been provided by <mailto:jaervosz@gentoo.org> Sune
Kloppenborg Jeppesen .
The original article can be found at:
<http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml>
http://www.gentoo.org/security/en/glsa/glsa-200508-02.xml

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.