Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.

The remote host is affected by the vulnerability described in GLSA-201309-15 (ProFTPD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ProFTPD. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process, perform man-in-the-middle attacks to spoof       arbitrary SSL servers, cause a Denial of Service condition, or read and       modify arbitrary files.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in ProFTPD, a versatile, virtual-hosting FTP daemon :

  - CVE-2008-7265     Incorrect handling of the ABOR command could lead to     denial of service through elevated CPU consumption.

  - CVE-2010-3867     Several directory traversal vulnerabilities have been     discovered in the mod_site_misc module.

  - CVE-2010-4562     A SQL injection vulnerability was discovered in the     mod_sql module.

A vulnerability has been found and corrected in proftpd :

Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of a SQL query (CVE-2010-4652).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

This is an update to the current upstream maintenance release, which addresses a security issue that could affect users of the mod_sql module (not enabled by default).

  - A heap-based buffer overflow flaw was found in the way     ProFTPD FTP server prepared SQL queries for certain     usernames, when the mod_sql module was enabled. A     remote, unauthenticated attacker could use this flaw to     cause the proftpd daemon to crash or, potentially, to     execute arbitrary code with the privileges of the user     running 'proftpd' via a specially crafted username,     provided in the authentication dialog.

The update also fixes a CPU spike when handling .ftpaccess files, and handling of SFTP uploads when compression is used.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is using ProFTPD, a free FTP server for Unix and Linux.

According to its banner, the version of ProFTPD installed on the remote host is earlier than 1.3.3d. Such versions are reportedly affected by a heap-based buffer overflow vulnerability in the function 'sql_prepare_where()' in the file 'contrib/mod_sql.c'. An unauthenticated, remote attacker may be able to exploit this in combination with an earlier SQL injection vulnerability (CVE-2009-0542) to execute arbitrary code with root privileges.

Note that Nessus did not actually test for the flaw but instead has relied on the version in ProFTPD's banner.

ID	Name	Product	Family	Severity
70111	GLSA-201309-15 : ProFTPD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
52660	Debian DSA-2191-1 : proftpd-dfsg - several vulnerabilities	Nessus	Debian Local Security Checks	high
51916	Mandriva Linux Security Advisory : proftpd (MDVSA-2011:023)	Nessus	Mandriva Local Security Checks	medium
51821	Fedora 13 : proftpd-1.3.3d-1.fc13 (2011-0613)	Nessus	Fedora Local Security Checks	medium
51820	Fedora 14 : proftpd-1.3.3d-1.fc14 (2011-0610)	Nessus	Fedora Local Security Checks	medium
51366	ProFTPD < 1.3.3d 'mod_sql' Buffer Overflow	Nessus	FTP	medium

Detections

Analytics

CVE-2010-4652

critical

Tenable Plugins

critical

high

medium

medium

medium

medium