|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Mandrake Local Security Checks >> MDKSA-2006:217-1: proftpd Vulnerability Assessment Details
|
MDKSA-2006:217-1: proftpd |
||
Check for the version of the proftpd package Detailed Explanation for this Vulnerability Assessment The remote host is missing the patch for the advisory MDKSA-2006:217-1 (proftpd). A stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier, permits remote attackers to cause a denial of service, as demonstrated by vd_proftpd.pm, a 'ProFTPD remote exploit.' (CVE-2006-5815) Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, permits remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815. (CVE-2006-6170) ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from an initial vague disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability. (CVE-2006-6171) Packages have been patched to correct these issues. Update: The previous update incorrectly linked the vd_proftd.pm issue with the CommandBufferSize issue. These are two distinct issues and the previous update only addressed CommandBufferSize (CVE-2006-6171), and the mod_tls issue (CVE-2006-6170). Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:217-1 Network Security Threat Level: High Networks Security ID: Vulnerability Assessment Copyright: This script is Copyright (C) 2007 Tenable Network Security |
||
Cables, Connectors |
Atari 8bit A8 Pico Cart XL XE XEGS - NEW
$20.00
A8picoCart Atari 130 / 65 XE 800 / 1200 XL XEGS multicart UnoCart clone game
$29.49
A8picoCart Atari 130 / 65 XE 800 / 1200 XL XEGS multicart UnoCart clone game
$29.50
Atari Portfolio 512K Bytes Card with USB file transfer utility
$109.00
Atari 400/800/XL/XE Computer SIO2PC - PC/Mac Disk Drive Emulator Adapter/Device
$15.25
Atari Portfolio 1 MegaByte Card with USB file transfer utility
$129.00
Atari Portfolio 1.5 MegaBytes Card with USB file transfer utility
$139.00
Atari Power Cube 800XL, 600XL, 65XE, 130XE USB-C Power Supply PSU
$11.25
Atari 1050 US Doubler upgrade kit
$35.00
UnoCart 2600 ATARI Uno cart cartridge
$62.75
|
||
No Discussions have been posted on this vulnerability. |