The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4077 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4077-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     March 02, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : proftpd-dfsg     Version        : 1.3.7a+dfsg-12+deb11u5     CVE ID         : CVE-2024-57392     Debian Bug     : 1090813

    proftpd a popular FTP server was affected by a vulnerability.

    CVE-2024-57392:

        Buffer Overflow vulnerability in Proftpd allowed a remote         attacker to execute arbitrary code and can cause a         Denial of Service (DoS) on the FTP service by sending a         maliciously crafted message to the ProFTPD service port.

    Moreover this release include some bug fixes:
    - - upstream issue #1171       Downloading a file contains the contents of another file.
    - - Fix the computation of he RADIUS Message-Authenticator       signature to conform more properly to RFC 2869. Fix       Blastradius breakage.

    For Debian 11 bullseye, this problem has been fixed in version     1.3.7a+dfsg-12+deb11u5.

    We recommend that you upgrade your proftpd-dfsg packages.

    For the detailed security status of proftpd-dfsg please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/proftpd-dfsg

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-4077 : proftpd-basic - security update

high Nessus Plugin ID 216986

Version 1.1