ProFTPD < 1.3.0rc2 Multiple Remote Format Strings

This script is Copyright (C) 2005-2014 Tenable Network Security, Inc.


Synopsis :

The remote FTP server is affected by multiple vulnerabilities.

Description :

The remote host is using ProFTPD, a free FTP server for Unix and
Linux.

According to its banner, the version of ProFTPD installed on the
remote host suffers from multiple format string vulnerabilities, one
involving the 'ftpshut' utility and the other in mod_sql's
'SQLShowInfo' directive. Exploitation of either requires involvement
on the part of a site administrator and can lead to information
disclosure, denial of service, and even a compromise of the affected
system.

See also :

http://www.proftpd.org/docs/RELEASE_NOTES-1.3.0rc2

Solution :

Upgrade to ProFTPD version 1.3.0rc2 or later.

Risk factor :

Medium / CVSS Base Score : 6.4
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS Temporal Score : 4.7
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: FTP

Nessus Plugin ID: 19302 ()

Bugtraq ID: 14380
14381

CVE ID: CVE-2005-2390