PT-2003-1673 · Postgresql+1 · Postgresql+1

Published 2003-07-04 · Updated 2008-09-05 · CVE-2003-0500

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: ProFTPD versions 1.2.9rc1 and earlier

Description: A SQL injection vulnerability exists in the PostgreSQL authentication module for ProFTPD, allowing remote attackers to execute arbitrary SQL and gain privileges by bypassing authentication or stealing passwords via the USER name. This is caused by the mod sql postgres backend module failing to properly filter escape strings, enabling a remote attacker to insert arbitrary SQL code during login and gain unauthorized access to the server.

Recommendations: For ProFTPD versions 1.2.9rc1 and earlier, update to version 1.2.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod sql postgres backend module until a patch is available. Avoid using the USER name field in a way that could allow arbitrary SQL code injection until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2003-0500

DSA-338

Affected Products

Postgresql

Proftpd

References · 7

• 🔥 https://exploit-db.com/exploits/43 · Exploit
• http://debian.org/security/2003/dsa-338 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2003-0500 · Security Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2003-June/005826.html · Note
• http://securityfocus.com/bid/7974 · Note
• http://xforce.iss.net/xforce/xfdb/12369 · Note