PT-2009-5911 · Proftpd · Proftpd

Jan Lieskovsky · Published 2009-10-28 · Updated 2024-06-15 · CVE-2009-3639

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.2b ProFTPD version 1.3.3 before 1.3.3rc2

Description The issue arises from improper handling of a '0' character in a domain name within the Subject Alternative Name field of an X.509 client certificate when the dNSNameRequired TLS option is enabled. This allows remote attackers to bypass intended client-hostname restrictions by using a crafted certificate issued by a legitimate Certification Authority.

Recommendations For ProFTPD versions prior to 1.3.2b, update to version 1.3.2b or later. For ProFTPD version 1.3.3 before 1.3.3rc2, update to version 1.3.3rc2 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-3639

DSA-1925-1

OPENSUSE-SU-2024:10048-1

Affected Products

Proftpd

References · 26

• https://nvd.nist.gov/vuln/detail/CVE-2009-3639 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2009-3639 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-November/msg00642.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-3639 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:288 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10048-1 · Vendor Advisory
• http://secunia.com/advisories/37131 · Vendor Advisory
• http://debian.org/security/2009/dsa-1925 · Vendor Advisory
• http://securityfocus.com/bid/36804 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-3639 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-November/msg00649.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=530719 · Patch
• http://marc.info/?l=oss-security&m=125632960508211&w=2 · Note
• http://secunia.com/advisories/37219 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53936 · Note