cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add proftpd remote root vulnerability.

Browse Source 
Based on:	Vladimir Nikolic <vladimir dot nikolic at amis dot net>
Feature proof:	yes
With hat:	secteam
This commit is contained in:
Remko Lodder 2010-11-23 16:38:51 +00:00
parent 192aaac600
commit 9cdf36a2e6
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=265014
1 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
security/vuxml/vuln.xml
View File

@ -34,6 +34,43 @@ Note: Please add new entries to the beginning of this file.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="533d20e7-f71f-11df-9ae1-000bcdf0a03b">
<topic>proftpd -- remote code execution vulnerability</topic>
<affects>
<package>
<name>proftpd</name>
<range><lt>1.3.3c</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Tippingpoint reports:</p>
<blockquote cite="http://www.zerodayinitiative.com/advisories/ZDI-10-229/">
<p>This vulnerability allows remote attackers to execute arbitrary
code on vulnerable installations of ProFTPD. Authentication is not
required to exploit this vulnerability.</p>
<p>The flaw exists within the proftpd server component which
listens by default on TCP port 21. When reading user input if a
TELNET_IAC escape sequence is encountered the process
miscalculates a buffer length counter value allowing a user
controlled copy of data to a stack buffer. A remote attacker can
exploit this vulnerability to execute arbitrary code under the
context of the proftpd process.</p>
</blockquote>
</body>
</description>
<references>
<bid>44562</bid>
<cvename>CVE-2010-4221</cvename>
<url>http://www.zerodayinitiative.com/advisories/ZDI-10-229/</url>
</references>
<dates>
<discovery>2010-11-FIXME</discovery>
<entry>2010-11-23</entry>
</dates>
</vuln>
<vuln vid="3042c33a-f237-11df-9d02-0018fe623f2b">
<topic>openssl -- TLS extension parsing race condition</topic>
<affects>