proftpd: remote root shell [LWN.net]

Package(s):

proftpd

CVE #(s):

CAN-2003-0831

Created:

September 24, 2003

Updated:

January 2, 2004

Description:

The ASCII translation mechanism in ProFTPD 1.2.8 contains a vulnerability which will provide a remote attacker with a root shell - if the attacker is able to download a specially-crafted file. See this ISS advisory for more information.

Alerts:

Mandrake	MDKSA-2003:095-1	2003-12-31
Conectiva	CLA-2003:750	2003-09-29
Gentoo	200309-16	2003-09-28
Trustix	2003-0037	2003-09-27
Mandrake	MDKSA-2003:095	2003-09-26
OpenPKG	OpenPKG-SA-2003.043	2003-09-25
Slackware	SSA:2003-259-02	2003-09-23

(Log in to post comments)

Debian?

Posted Oct 2, 2003 3:33 UTC (Thu) by mmealman (guest, #9223) [Link]

Why hasn't Debian posted an update to this package yet?

Debian?

Posted Jan 12, 2004 16:00 UTC (Mon) by petebull (subscriber, #7857) [Link]

Because it's not yet in the stable distribution.

unstable and testing will get new packages but there will be no advisory.

Peter