PT-2008-6877 · Proftpd+1 · Proftpd-Ldap+4

Maksymilian Arciemowicz · Published 1970-01-01 · Updated 2017-08-08 · CVE-2008-4242

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions proftpd-ldap (affected versions not specified) proftpd-pgsql (affected versions not specified) proftpd-mysql (affected versions not specified) ProFTPD version 1.3.1

Description The issue concerns multiple vulnerabilities in the proftpd packages of the Debian GNU/Linux operating system, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Additionally, a specific vulnerability in ProFTPD 1.3.1 allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.

Recommendations For proftpd-ldap, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For proftpd-pgsql, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For proftpd-mysql, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ProFTPD version 1.3.1, consider restricting access to the FTP server to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using long ftp:// URIs in web browsers to prevent CSRF attacks.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2015-00987

BDU:2015-00988

BDU:2015-00989

CVE-2008-4242

DSA-1689-1

Affected Products

Debian

Proftpd

Proftpd-Ldap

Proftpd-Mysql

Proftpd-Pgsql

References · 22

• 🔥 http://securityfocus.com/bid/31289 · Exploit
• https://bdu.fstec.ru/vul/2015-00989 · Security Note
• http://debian.org/security/2008/dsa-1689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4242 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4242 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00988 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4242 · Security Note
• https://osv.dev/vulnerability/CVE-2008-4242 · Vendor Advisory
• http://secunia.com/advisories/31930 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-January/msg00245.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-4242 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-January/msg00078.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00987 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:061 · Vendor Advisory
• http://debian.org/security/dsa-1689 · Note