PT-2009-5911 · Proftpd · Proftpd

Jan Lieskovsky · Publicado 2009-10-28 · Atualizado 2024-06-15 · CVE-2009-3639

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.2b ProFTPD version 1.3.3 before 1.3.3rc2

Description The issue arises from improper handling of a '0' character in a domain name within the Subject Alternative Name field of an X.509 client certificate when the dNSNameRequired TLS option is enabled. This allows remote attackers to bypass intended client-hostname restrictions by using a crafted certificate issued by a legitimate Certification Authority.

Recommendations For ProFTPD versions prior to 1.3.2b, update to version 1.3.2b or later. For ProFTPD version 1.3.3 before 1.3.3rc2, update to version 1.3.3rc2 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-3639

DSA-1925-1

OPENSUSE-SU-2024:10048-1

Produtos afetados

Proftpd

Referências · 26

• http://marc.info/?l=oss-security&m=125632960508211&w=2 · Nota
• http://secunia.com/advisories/37219 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3639 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53936 · Nota
• https://suse.com/security/cve/CVE-2011-1137 · Nota
• https://security-tracker.debian.org/tracker/CVE-2009-3639 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2009-November/msg00642.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-3306 · Nota
• https://osv.dev/vulnerability/CVE-2009-3639 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2009-0542 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2009:288 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10048-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2009-0543 · Nota
• http://secunia.com/advisories/37131 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2009-3639 · Nota