The remote host is using ProFTPD, a free FTP server for Unix and Linux.

According to its banner, the version of ProFTPD installed on the remote host is earlier than 1.3.0a. As such, it may be affected by one or more of the following vulnerabilities :

  - An off-by-one string manipulation flaw exists in the     'sreplace' function.  (CVE-2006-5815)

  - A buffer overflow exists in the 'tls_x509_name_oneline'     function of the mod_tls module involving the data     length argument. (CVE-2006-6170)

  - An off-by-two buffer overflow exists due to a failure     to properly set the buffer size limit when     'CommandBufferSize' is specified in the configuration     file, an issue which is disputed by the developers.
    (CVE-2006-6171)

An attacker may be able to leverage this issue to crash the affected service or execute arbitrary code remotely, subject to the privileges under which the application operates.

UnixおよびLinux用の無料のFTPサーバーであるProFTPDが、リモートホストで使用されています。

バナーによると、リモートホストにインストールされているProFTPDのバージョンは1.3.0aより前です。そのため、以下のいずれかの脆弱性の影響を受ける可能性があります。

  -「sreplace」関数にoff-by-one文字列操作の欠陥が存在します。（CVE-2006-5815）

  - mod_tlsモジュールの「tls_x509_name_oneline」関数に、データ長引数に関するバッファオーバーフローが存在します。（CVE-2006-6170）

  -「CommandBufferSize」が構成ファイルで指定されているときにバッファサイズ制限を適切に設定できないことによる、off-by-twoバッファオーバーフローが存在します。この問題は開発者によって議論されています。
    （CVE-2006-6171）

攻撃者が、この問題を利用して、影響を受けるサービスをクラッシュさせたり、リモートで任意のコードを実行させたりする可能性があります。これは、アプリケーションが動作している権限の対象になります。

遠端主機正在使用 ProFTPD，其為適用於 Unix 和 Linux 的免費 FTP 伺服器。

根據其標題來判斷，遠端主機上安裝的 ProFTPD 版本比 1.3.0a 舊。因此，可能受到以下一個或多個弱點影響：

  - 「sreplace」函式中有一個差一字串操控瑕疵。(CVE-2006-5815)

  - mod_tls 模組的「tls_x509_name_oneline」函式中有一個涉及資料長度引數的緩衝區溢位弱點。(CVE-2006-6170)

  - 有一個差二緩衝區溢位弱點，這是在設定檔中指定「CommandBufferSize」時無法正確設定緩衝區大小限制所導致，開發人員對此問題存在爭議。
    (CVE-2006-6171)

攻擊者或可利用此問題損毀受影響的服務或在遠端執行任意程式碼，但這需要具有執行此應用程式的權限。

远程主机正在使用 ProFTPD，一款用于 Unix 和 Linux 的免费 FTP 服务器。

根据其标题，远程主机上安装的 ProFTPD 版本低于 1.3.0a。因此，该软件可能受到一个或多个以下漏洞的影响：

  - “sreplace”函数中存在一个差一字符串操纵缺陷。(CVE-2006-5815)

  - mod_tls 模块的“tls_x509_name_oneline”函数中存在一个与数据长度参数有关的缓冲区溢出漏洞。(CVE-2006-6170)

  - 存在一个差二缓冲区溢出漏洞，这是当在配置文件中指定“CommandBufferSize”时未能正确设置缓冲区大小限制所致，但开发人员对此问题存在争议。
    (CVE-2006-6171)

攻击者可能会利用此问题导致受影响的服务崩溃，或以运行应用程序的特权远程执行任意代码。

New proftpd packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security issues.

The remote host is affected by the vulnerability described in GLSA-200611-26 (ProFTPD: Remote execution of arbitrary code)

    Evgeny Legerov discovered a stack-based buffer overflow in the     s_replace() function in support.c, as well as a buffer overflow in in     the mod_tls module. Additionally, an off-by-two error related to the     CommandBufferSize configuration directive was reported.
  Impact :

    An authenticated attacker could exploit the s_replace() vulnerability     by uploading a crafted .message file or sending specially crafted     commands to the server, possibly resulting in the execution of     arbitrary code with the rights of the user running ProFTPD. An     unauthenticated attacker could send specially crafted data to the     server with mod_tls enabled which could result in the execution of     arbitrary code with the rights of the user running ProFTPD. Finally,     the off-by-two error related to the CommandBufferSize configuration     directive was fixed - exploitability of this error is disputed. Note     that the default configuration on Gentoo is to run ProFTPD as an     unprivileged user, and has mod_tls disabled.
  Workaround :

    There is no known workaround at this time.

A stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier, allows remote attackers to cause a denial of service, as demonstrated by vd_proftpd.pm, a 'ProFTPD remote exploit.' (CVE-2006-5815)

Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815. (CVE-2006-6170)

ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from an initial vague disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability. (CVE-2006-6171)

Packages have been patched to correct these issues.

Update :

The previous update incorrectly linked the vd_proftd.pm issue with the CommandBufferSize issue. These are two distinct issues and the previous update only addressed CommandBufferSize (CVE-2006-6171), and the mod_tls issue (CVE-2006-6170).

It was discovered that the proftpd FTP daemon performs insufficient validation of FTP command buffer size limits, which may lead to denial of service.

Due to technical problems yesterday's proftpd update lacked a build for the amd64 architecture, which is now available. For reference please find below the original advisory text :

  Several remote vulnerabilities have been discovered in the proftpd   FTP daemon, which may lead to the execution of arbitrary code or   denial of service. The Common Vulnerabilities and Exposures project   identifies the following problems :

    - CVE-2006-5815       It was discovered that a buffer overflow in the       sreplace() function may lead to denial of service and       possibly the execution of arbitrary code.

    - CVE-2006-6170       It was discovered that a buffer overflow in the       mod_tls addon module may lead to the execution of       arbitrary code.

    - CVE-2006-6171       It was discovered that insufficient validation of FTP       command buffer size limits may lead to denial of       service. Due to unclear information this issue was       already fixed in DSA-1218 as CVE-2006-5815.

ID	名稱	產品	系列	已發布	已更新	嚴重性
27055	ProFTPD < 1.3.0a Multiple Vulnerabilities	Nessus	FTP	2007/10/15	2018/11/15	critical
27055	ProFTPD < 1.3.0aの複数の脆弱性	Nessus	FTP	2007/10/15	2018/11/15	critical
27055	ProFTPD < 1.3.0a 多個弱點	Nessus	FTP	2007/10/15	2018/11/15	critical
27055	ProFTPD < 1.3.0a 多种漏洞	Nessus	FTP	2007/10/15	2018/11/15	critical
24660	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 : proftpd (SSA:2006-335-02)	Nessus	Slackware Local Security Checks	2007/2/18	2021/1/14	critical
23762	GLSA-200611-26 : ProFTPD: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	2006/12/4	2021/1/6	critical
24602	Mandrake Linux Security Advisory : proftpd (MDKSA-2006:217-1)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	critical
23704	Debian DSA-1218-1 : proftpd - programming error	Nessus	Debian Local Security Checks	2006/11/22	2021/1/4	high
23757	Debian DSA-1222-2 : proftpd - several vulnerabilities	Nessus	Debian Local Security Checks	2006/12/4	2021/1/4	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

high

critical