Nessus Plugin #17145

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[GLSA-200502-26] GProFTPD: gprostats format string vulnerability

Family:

Gentoo Local Security Checks

Category:

infos

Copyright:

(C) 2005 Michel Arboi

Summary:

GProFTPD: gprostats format string vulnerability

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

GLSA:200502-26

Description:

The remote host is affected by the vulnerability described in GLSA-200502-26
(GProFTPD: gprostats format string vulnerability)


Tavis Ormandy of the Gentoo Linux Security Audit Team has
identified a format string vulnerability in the gprostats utility.

Impact

An attacker could exploit the vulnerability by performing a
specially crafted FTP transfer, the resulting ProFTPD transfer log
could potentially trigger the execution of arbitrary code when parsed
by GProFTPD.

Workaround

There is no known workaround at this time.


Solution:
All GProFTPD users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-ftp/gproftpd-8.1.9"


Risk factor : Medium