Fedora 10 : proftpd-1.3.2b-1.fc10 (2009-11666)

medium Nessus Plugin ID 42846

Synopsis

The remote Fedora host is missing a security update.

Description

This update fixes CVE-2009-3639, in which proftpd's mod_tls, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate. This allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority. This update to upstream release 1.3.2b also fixes the following issues recorded in the proftpd bug tracker at bugs.proftpd.org: - Regression causing command-line define options not to work (bug 3221) - Use correct cached user values with 'SQLNegativeCache on' (bug 3282) - Slower transfers of multiple small files (bug 3284) - Support MaxTransfersPerHost, MaxTransfersPerUser properly (bug 3287) - Handle symlinks to directories with trailing slashes properly (bug 3297)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected proftpd package.

Plugin Details

Severity: Medium

ID: 42846

File Name: fedora_2009-11666.nasl

Version: 1.14

Type: local

Agent: unix

Family: Fedora Local Security Checks

Published: 11/19/2009

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.5

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:10, p-cpe:/a:fedoraproject:fedora:proftpd

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/18/2009

Reference Information

CVE: CVE-2009-3639

BID: 36804

CWE: 310

FEDORA: 2009-11666

Detections

Analytics