OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2006.039
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2006.039
Advisory Published:      2008-10-06 23:00 UTC

Issue Id (internal):     OpenPKG-SI-20061215.01
Issue First Created:     2006-12-15
Issue Last Modified:     2007-04-13
Issue Revision:          11


Subject Name:            ProFTPD
Subject Summary:         Professional FTP Daemon
Subject Home:            http://www.proftpd.org/
Subject Versions:        * < 1.3.1rc1

Vulnerability Id:        CVE-2006-6563
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           denial of service, privilege escalation,
                         arbitrary code execution

Description:
    A vulnerability exists in the FTP server ProFTPD, versions up to
    and including 1.3.0a. The vulnerability is caused by a stack-based
    buffer overflow in the "pr_ctrls_recv_request" function of the
    "Controls" feature. This is an optional feature of ProFTPD server
    which is by default disabled in OpenPKG and that must be explicitly
    activated with the "with_ctrls" build-time option of the OpenPKG
    "profptd" package.
    
    Controls are a way to communicate directly with a standalone ProFTPD
    daemon while it is running. This provides administrators a way to
    alter the daemon's behavior in real time, without having to restart
    the daemon and have it re-read its configuration. The Controls
    feature allows authorized users to locally manage parameters of the
    ProFTPD servers, like aborting connections, managing users, changing
    log levels, disabling individual virtual servers, etc.
    
    The vulnerability allows local attackers with access to the
    Controls features (and who have been allowed by Controls ACLs
    in "proftpd.conf") to execute arbitrary code or even gain root
    privileges.

References:
    [0] http://www.proftpd.org/


Primary Package Name:    proftpd
Primary Package Home:    http://openpkg.org/go/package/proftpd

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Enterprise       E1.0-SOLID        proftpd-1.3.0-E1.0.1
OpenPKG Community        2-STABLE-20061018 proftpd-1.3.0-2.20061116
OpenPKG Community        2-STABLE          proftpd-1.3.0-2.20061128
OpenPKG Community        CURRENT           proftpd-1.3.0-20061214

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Enterprise       E1.0-SOLID        proftpd-1.3.0-E1.0.2
OpenPKG Community        2-STABLE-20061018 pending
OpenPKG Community        2-STABLE          pending
OpenPKG Community        CURRENT           proftpd-1.3.0a-20060413