proftpd privilege escalation [LWN.net]

Package(s):

proftpd

CVE #(s):

Created:

April 30, 2004

Updated:

May 19, 2004

Description:

A portability workaround was applied in version 1.2.9 of the FTP server ProFTPD. As a side-effect, CIDR based (aaa.bbb.ccc.ddd/NN) ACL entries in "Allow" and "Deny" directives act like an "AllowAll" directive and so FTP clients are granted access to files and directories although the server configuration might explicitly deny this. See this bug report.

Alerts:

Gentoo	200405-09	2004-05-19
Mandrake	MDKSA-2004:041	2004-04-30
OpenPKG	OpenPKG-SA-2004.018	2004-04-30

(Log in to post comments)