Mandriva Linux Security Advisory : proftpd (MDVSA-2013:245)

medium Nessus Plugin ID 70300

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

A vulnerability has been discovered and corrected in proftpd :

Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation (CVE-2013-4359).

The updated packages have been patched to correct this issue.

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 70300

File Name: mandriva_MDVSA-2013-245.nasl

Version: 1.5

Type: local

Family: Mandriva Local Security Checks

Published: 10/4/2013

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.2

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:proftpd-mod_wrap_sql, cpe:/o:mandriva:business_server:1, p-cpe:/a:mandriva:linux:proftpd, p-cpe:/a:mandriva:linux:proftpd-devel, p-cpe:/a:mandriva:linux:proftpd-mod_autohost, p-cpe:/a:mandriva:linux:proftpd-mod_ban, p-cpe:/a:mandriva:linux:proftpd-mod_case, p-cpe:/a:mandriva:linux:proftpd-mod_ctrls_admin, p-cpe:/a:mandriva:linux:proftpd-mod_gss, p-cpe:/a:mandriva:linux:proftpd-mod_ifsession, p-cpe:/a:mandriva:linux:proftpd-mod_ldap, p-cpe:/a:mandriva:linux:proftpd-mod_load, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_file, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_ldap, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_radius, p-cpe:/a:mandriva:linux:proftpd-mod_quotatab_sql, p-cpe:/a:mandriva:linux:proftpd-mod_radius, p-cpe:/a:mandriva:linux:proftpd-mod_ratio, p-cpe:/a:mandriva:linux:proftpd-mod_rewrite, p-cpe:/a:mandriva:linux:proftpd-mod_sftp, p-cpe:/a:mandriva:linux:proftpd-mod_shaper, p-cpe:/a:mandriva:linux:proftpd-mod_site_misc, p-cpe:/a:mandriva:linux:proftpd-mod_sql, p-cpe:/a:mandriva:linux:proftpd-mod_sql_mysql, p-cpe:/a:mandriva:linux:proftpd-mod_sql_passwd, p-cpe:/a:mandriva:linux:proftpd-mod_sql_postgres, p-cpe:/a:mandriva:linux:proftpd-mod_time, p-cpe:/a:mandriva:linux:proftpd-mod_tls, p-cpe:/a:mandriva:linux:proftpd-mod_vroot, p-cpe:/a:mandriva:linux:proftpd-mod_wrap, p-cpe:/a:mandriva:linux:proftpd-mod_wrap_file

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 10/3/2013

Reference Information

CVE: CVE-2013-4359

MDVSA: 2013:245

Detections

Analytics