Re: ProFTPD still vulnerable (Sarge)

["Stefan Fritsch" <sf@sfritsch.de>]

Hi,

> The attacks ceased before I noticed, so I was not able to capture a TCP
> stream. I would just like to alert people that there is still some
> vulnerability in the ProFTPD code that was not fixed by DSA-1218-1.

yes, there are two open vulnerabilites in proftpd. A DSA should be in the
works, but I don't know the current status.

One is CVE-2006-5815 and the other is a mod_tls vulnerability without CVE
id yet. AFAIK there is no exploit for sarge's 1.2.x for CVE-2006-5815 yet.
So I would expect this to be the mod_tls vulnerability. Do you have
mod_tls enabled? Try connecting to your server with telnet and enter FEAT
and see whether it returns AUTH TLS.

There is a thread about this at
http://lists.alioth.debian.org/pipermail/secure-testing-team/2006-November/000972.html


NOTE: Users of etch/sid should upgrade to 1.3.0-16 *NOW*.

Cheers,
Stefan