Mandrake Linux Security Advisory : proftpd (MDKSA-2006:232)

medium Nessus Plugin ID 24615

Synopsis

The remote Mandrake Linux host is missing one or more security updates.

Description

Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.

Packages have been patched to correct these issues.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 24615

File Name: mandrake_MDKSA-2006-232.nasl

Version: 1.16

Type: local

Family: Mandriva Local Security Checks

Published: 2/18/2007

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.6

Vector: CVSS2#AV:L/AC:M/Au:S/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:proftpd, p-cpe:/a:mandriva:linux:proftpd-anonymous, p-cpe:/a:mandriva:linux:proftpd-mod_autohost, p-cpe:/a:mandriva:linux:proftpd-mod_case, p-cpe:/a:mandriva:linux:proftpd-mod_clamav, p-cpe:/a:mandriva:linux:proftpd-mod_ctrls_admin, p-cpe:/a:mandriva:linux:proftpd-mod_facl, p-cpe:/a:mandriva:linux:proftpd-mod_gss, p-cpe:/a:mandriva:linux:proftpd-mod_ifsession, p-cpe:/a:mandriva:linux:proftpd-mod_ldap, p-cpe:/a:mandriva:linux:proftpd-mod_load, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_file, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_ldap, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_sql, p-cpe:/a:mandriva:linux:proftpd-mod_radius, p-cpe:/a:mandriva:linux:proftpd-mod_ratio, p-cpe:/a:mandriva:linux:proftpd-mod_rewrite, p-cpe:/a:mandriva:linux:proftpd-mod_shaper, p-cpe:/a:mandriva:linux:proftpd-mod_site_misc, p-cpe:/a:mandriva:linux:proftpd-mod_sql, p-cpe:/a:mandriva:linux:proftpd-mod_sql_mysql, p-cpe:/a:mandriva:linux:proftpd-mod_sql_postgres, p-cpe:/a:mandriva:linux:proftpd-mod_time, p-cpe:/a:mandriva:linux:proftpd-mod_tls, p-cpe:/a:mandriva:linux:proftpd-mod_wrap, p-cpe:/a:mandriva:linux:proftpd-mod_wrap_file, p-cpe:/a:mandriva:linux:proftpd-mod_wrap_sql, cpe:/o:mandriva:linux:2007

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/18/2006

Exploitable With

Core Impact

Reference Information

CVE: CVE-2006-6563

MDKSA: 2006:232

Detections

Analytics