PT-2001-2585 · Proftpd · Proftpd

Published 2001-12-31 · Updated 2017-12-19 · CVE-2001-1500

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProFTPD versions 1.2.2rc2 and possibly other versions

Description The issue allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged due to improper verification of reverse-resolved hostnames by not performing forward resolution.

Recommendations For ProFTPD version 1.2.2rc2, consider updating to a newer version that properly verifies hostnames to prevent ACL bypass and incorrect logging. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1500

Affected Products

Proftpd

References · 6

• http://mandriva.com/security/advisories?name=MDKSA-2002:005 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000450 · Vendor Advisory
• http://securityfocus.com/bid/3310 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2001-1500 · Security Note
• http://securityfocus.com/archive/1/212805 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7126 · Note