Detections
Analytics

FreeBSD : proftpd -- Long Command Processing Vulnerability (0f51f2c9-8956-11dd-a6fe-0030843d3802)

high Nessus Plugin ID 34256

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Secunia reports :

The vulnerability is caused due to the application truncating an overly long FTP command, and improperly interpreting the remainder string as a new FTP command. This can be exploited to execute arbitrary FTP commands with the privileges of another user by e.g.
tricking the user into following malicious link.

Solution

Update the affected packages.

See Also

http://bugs.proftpd.org/show_bug.cgi?id=3115

http://www.nessus.org/u?17415b90

Plugin Details

Severity: High

ID: 34256

File Name: freebsd_pkg_0f51f2c9895611dda6fe0030843d3802.nasl

Version: 1.17

Type: local

Published: 9/23/2008

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:proftpd, p-cpe:/a:freebsd:freebsd:proftpd-devel, p-cpe:/a:freebsd:freebsd:proftpd-mysql, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 9/23/2008

Vulnerability Publication Date: 9/22/2008

Reference Information

CVE: CVE-2008-4242, CVE-2008-4247

CWE: 352

Secunia: 31930