Detections
Analytics
Debian DSA-3263-1 : proftpd-dfsg - security update
critical Nessus Plugin ID 83546
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Vadim Melihow discovered that in proftpd-dfsg, an FTP server, the mod_copy module allowed unauthenticated users to copy files around on the server, and possibly to execute arbitrary code.Solution
Upgrade the proftpd-dfsg packages.For the oldstable distribution (wheezy), this problem has been fixed in version 1.3.4a-5+deb7u3.
For the stable distribution (jessie), this problem has been fixed in version 1.3.5-1.1+deb8u1.
See Also
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782781
https://packages.debian.org/source/jessie/proftpd-dfsg
Plugin Details
Severity: Critical
ID: 83546
File Name: debian_DSA-3263.nasl
Version: 2.11
Type: Local
Agent: unix
Family: Debian Local Security Checks
Published: 5/20/2015
Updated: 10/8/2026
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.3
Percentile: 99.82
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.3
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2015-3306
CVSS v3
Risk Factor: Critical
Base Score: 10
Temporal Score: 9.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:debian:debian_linux:7.0, cpe:/o:debian:debian_linux:8.0, p-cpe:/a:debian:debian_linux:proftpd-dfsg
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/19/2015
CISA Known Exploited Vulnerability Due Dates: 10/11/2026
Exploitable With
CANVAS (CANVAS)
Metasploit (ProFTPD 1.3.5 Mod_Copy Command Execution)
Reference Information
CVE: CVE-2015-3306
BID: 74238
DSA: 3263