The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

The remote host is running a version of ProFTPD that is affected by an information disclosure vulnerability in the mod_copy module due to the SITE CPFR and SITE CPTO commands being available to unauthenticated clients. An unauthenticated, remote attacker can exploit this flaw to read and write to arbitrary files on any web accessible path on the host.

The ftp server ProFTPD was updated to 1.3.5a to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-3306: Unauthenticated copying of files via SITE     CPFR/CPTO allowed by mod_copy (boo#927290)

In addition, proftpd was updated to 1.3.5a to fix a number of upstream bugs and improve functionality.

ProFTPd development team reports :

Vadim Melihow reported a critical issue with proftpd installations that use the mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands to be used by *unauthenticated clients*.

Vadim Melihow discovered that in proftpd-dfsg, an FTP server, the mod_copy module allowed unauthenticated users to copy files around on the server, and possibly to execute arbitrary code.

Vadim Melihow reported a critical issue with proftpd installations that use the mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands to be used by unauthenticated clients

Upstream report: http://bugs.proftpd.org/show_bug.cgi?id=4169

Note that mod_copy is not loaded/enabled by default in the Fedora package.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Vadim Melihow reported a critical issue with proftpd installations that use the mod_copy module's SITE CPFR/SITE CPTO commands; mod_copy allows these commands to be used by *unauthenticated clients*

Upstream report: http://bugs.proftpd.org/show_bug.cgi?id=4169

This update contains a backported fix for this issue.

Note that mod_copy is not loaded/enabled by default in the Fedora package.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New proftpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue.

ID	Name	Product	Family	Severity
84215	ProFTPD mod_copy Information Disclosure	Nessus	FTP	critical
84134	openSUSE Security Update : proftpd (openSUSE-2015-410)	Nessus	SuSE Local Security Checks	critical
83752	FreeBSD : proftpd -- arbitrary code execution vulnerability with chroot (d0034536-ff24-11e4-a072-d050996490d0)	Nessus	FreeBSD Local Security Checks	critical
83546	Debian DSA-3263-1 : proftpd-dfsg - security update	Nessus	Debian Local Security Checks	critical
83323	Fedora 21 : proftpd-1.3.5-5.fc21 (2015-7086)	Nessus	Fedora Local Security Checks	critical
83224	Fedora 22 : proftpd-1.3.5-6.fc22 (2015-7164)	Nessus	Fedora Local Security Checks	critical
83198	Fedora 20 : proftpd-1.3.4e-3.fc20 (2015-6401)	Nessus	Fedora Local Security Checks	critical
82925	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : proftpd (SSA:2015-111-12)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2015-3306

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical