1. Gentoo Linux Security Advisory
| Advisory Reference | GLSA 200702-02 / proftpd |
| Release Date | February 13, 2007 |
| Latest Revision | February 13, 2007: 01 |
| Impact | high |
| Exploitable | local |
| Package | Vulnerable versions | Unaffected versions | Architecture(s) |
| net-ftp/proftpd | < 1.3.1_rc1 | >= 1.3.1_rc1 | All supported architectures |
Related bugreports: #158122
A flaw in ProFTPD may allow a local attacker to obtain root privileges.
ProFTPD is a powerful, configurable, and free FTP daemon.
A flaw exists in the mod_ctrls module of ProFTPD, normally used to allow FTP server administrators to configure the daemon at runtime.
An FTP server administrator permitted to interact with mod_ctrls could potentially compromise the ProFTPD process and execute arbitrary code with the privileges of the FTP Daemon, which is normally the root user.
Disable mod_ctrls, or ensure only trusted users can access this feature.
All ProFTPD users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync # emerge --ask --oneshot --verbose ">=net-ftp/proftpd-1.3.1_rc1" |