• info
• discussion
• exploit
• solution
• references

ProFTPD SQL Injection mod_sql Vulnerability

Solution:
It is recommended that all Gentoo users who are running net-ftp/proftpd upgrade to proftpd-1.2.9_rc1 with the following commands:

emerge sync
emerge proftpd
emerge clean

Debian has released an advisory DSA 338-1. Information about obtaining and applying fixes can be found in the referenced advisory.


ProFTPD Project ProFTPD 1.2 pre9

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre4

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre5

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre7

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre3

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre2

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre8

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre11

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre6

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2 pre10

• Debian proftpd_1.2.0pre10-2potato1_arm.deb
  http://security.debian.org/debian-security/dists/stable/updates/main/b inary-arm/proftpd_1.2.0pre10-2potato1_arm.deb

ProFTPD Project ProFTPD 1.2.4

• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_alpha.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_alpha.deb


• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_arm.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_arm.deb


• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_i386.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_i386.deb


• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_ia64.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_ia64.deb


• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_mips.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_mips.deb


• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_mipsel.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_mipsel.deb


• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_powerpc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_powerpc.deb


• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_s390.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_s390.deb


• Debian proftpd-common_1.2.4+1.2.5rc1-5woody2_sparc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_ 1.2.4+1.2.5rc1-5woody2_sparc.deb


• Debian proftpd-doc_1.2.4+1.2.5rc1-5woody2_all.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-doc_1.2 .4+1.2.5rc1-5woody2_all.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_alpha.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_alpha.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_arm.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_arm.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_i386.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_i386.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_ia64.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_ia64.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_m68k.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_m68k.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_mips.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_mips.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_mipsel.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_mipsel.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_powerpc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_powerpc.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_s390.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_s390.deb


• Debian proftpd-ldap_1.2.4+1.2.5rc1-5woody2_sparc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1. 2.4+1.2.5rc1-5woody2_sparc.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_alpha.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_alpha.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_arm.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_arm.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_i386.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_i386.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_m68k.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_m68k.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_mips.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_mips.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_mipsel.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_mipsel.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_powerpc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_powerpc.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_s390.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_s390.deb


• Debian proftpd-mysql_1.2.4+1.2.5rc1-5woody2_sparc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1 .2.4+1.2.5rc1-5woody2_sparc.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_alpha.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_alpha.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_arm.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_arm.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_i386.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_i386.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_m68k.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_m68k.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_mips.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_mips.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_mipsel.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_mipsel.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_powerpc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_powerpc.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_s390.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_s390.deb


• Debian proftpd-pgsql_1.2.4+1.2.5rc1-5woody2_sparc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1 .2.4+1.2.5rc1-5woody2_sparc.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_alpha.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_alpha.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_arm.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_arm.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_i386.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_i386.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_ia64.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_ia64.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_mips.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_mips.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_mipsel.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_mipsel.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_powerpc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_powerpc.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_s390.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_s390.deb


• Debian proftpd_1.2.4+1.2.5rc1-5woody2_sparc.deb
  Debian GNU/Linux 3.0 (woody)
  http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.4+1 .2.5rc1-5woody2_sparc.deb