----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
ProFTPD Two Format String Vulnerabilities

SECUNIA ADVISORY ID:
SA16181

VERIFY ADVISORY:
http://secunia.com/advisories/16181/

CRITICAL:
Moderately critical

IMPACT:
Exposure of sensitive information, DoS, System access

WHERE:
>From remote

SOFTWARE:
ProFTPD 1.2.x
http://secunia.com/product/1250/
ProFTPD 1.3.x
http://secunia.com/product/5430/

DESCRIPTION:
Two vulnerabilities have been reported in ProFTPD, which can be
exploited by malicious users to disclose certain sensitive
information, cause a DoS (Denial of Service), or potentially
compromise a vulnerable system.

1) A format string error exists when displaying a shutdown message
containing the name of the current directory. This can be exploited
by a user, who creates a directory containing format specifiers and
sets the directory as the current directory, when the shutdown
message is being sent.

Successful exploitation requires a shutdown message containing the
"%C", "%R", or "%U" variables.

2) A format string error exists when displaying response messages to
the client using information retrieved from a database using mod_sql.
This can be exploited by a user, who inserts format string sequences
into database tables that are used to generate the response
messages.

Successful exploitation requires that the "SQLShowInfo" directive is
set and also requires the user to have control over the contents of
the used tables in the database.

SOLUTION:
The  vulnerabilities have been fixed in version 1.3.0rc2.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits infamous42md.

ORIGINAL ADVISORY:
http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------