• info
• discussion
• exploit
• solution
• references

Multiple Vendor FTP glob Expansion Vulnerability

Solution:
This issue was remedied in ProFTPD versions later than 1.2.1.

Upgrades are available.


ProFTPD Project ProFTPD 1.2 .0rc3

• Conectiva proftpd-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/proftpd-1.2.5rc1-1U50_1cl .i386.rpm


• Conectiva proftpd-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/proftpd -1.2.5rc1-1U50_1cl.i386.rpm


• Conectiva proftpd-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/proftpd- 1.2.5rc1-1U50_1cl.i386.rpm


• Conectiva proftpd-1.2.5rc1-1U51_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/proftpd-1.2.5rc1-1U51_1cl .i386.rpm


• Conectiva proftpd-1.2.5rc1-1U60_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/proftpd-1.2.5rc1-1U60_1cl .i386.rpm


• Conectiva proftpd-1.2.5rc1-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/proftpd-1.2.5rc1-1U70_1cl .i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/proftpd-doc-1.2.5rc1-1U50 _1cl.i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/proftpd- doc-1.2.5rc1-1U50_1cl.i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U51_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/proftpd-doc-1.2.5rc1-1U51 _1cl.i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U60_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/proftpd-doc-1.2.5rc1-1U60 _1cl.i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/proftpd-doc-1.2.5rc1-1U70 _1cl.i386.rpm


• Mandrake proftpd-1.2.5-0.rc1.1.2mdk.i586.rpm
  Mandrake Linux 7.2 i586 upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake proftpd-1.2.5-0.rc1.1mdk.i586.rpm
  Mandrake Linux 8.0 i586 upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake proftpd-1.2.5-0.rc1.1mdk.i586.rpm
  Mandrake Linux 8.1 i586 upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake proftpd-1.2.5-0.rc1.1mdk.ppc.rpm
  Mandrake Linux 8.0 PPC upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake proftpd-1.2.5-0.rc1.2mdk.ia64.rpm
  Mandrake Linux 8.1 IA64 upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre4

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre5

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre8

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre11

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre6

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre1

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre9

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre7

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre3

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre2

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre10

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2.1

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

HP HP-UX 10.0 1

• HP PHNE_23947
  http://itrc.hp.com

HP HP-UX 10.10

• HP PHNE_23947
  http://itrc.hp.com

HP HP-UX 10.20

• HP PHNE_23948
  http://itrc.hp.com

HP HP-UX 11.0

• HP PHNE_23949
  http://itrc.hp.com

HP HP-UX 11.11

• HP PHNE_23950
  http://itrc.hp.com