PT-2005-3304 · Proftpd · Proftpd

Published 2005-07-27 · Updated 2016-10-18 · CVE-2005-2390

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.0rc2

Description The issue allows attackers to cause a denial of service or obtain sensitive information. This can be achieved via certain inputs to the shutdown message from ftpshut, or the SQLShowInfo mod sql directive.

Recommendations For versions prior to 1.3.0rc2, update to version 1.3.0rc2 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod sql directive and limiting inputs to the shutdown message from ftpshut to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-2390

DSA-795-2

Affected Products

Proftpd

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2005-2390 · Security Note
• http://secunia.com/advisories/16181 · Vendor Advisory
• http://debian.org/security/2005/dsa-795 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=112604373503912&w=2 · Vendor Advisory
• http://securitylab.ru/56189.html · Note
• http://securityfocus.com/bid/14381 · Note
• http://proftpd.org/docs/RELEASE_NOTES-1.3.0rc2 · Note
• http://securityfocus.com/bid/14380 · Note