The ProFTPD release notes states :

sean <infamous42md at hotpop.com> found two format string vulnerabilities, one in mod_sql's SQLShowInfo directive, and one involving the 'ftpshut' utility. Both can be considered low risk, as they require active involvement on the part of the site administrator in order to be exploited.

These vulnerabilities could potentially lead to information disclosure, a denial-of-server situation, or execution of arbitrary code with the permissions of the user running ProFTPD.

遠端主機正在使用 ProFTPD，其為適用於 Unix 和 Linux 的免費 FTP 伺服器。

根據其標題，遠端主機上安裝的 ProFTPD 版本受到多個格式字串弱點影響，其中一個涉及「ftpshut」公用程式，另一個位於 mod_sql 的「SQLShowInfo」指示詞中。若要惡意利用其中任何一個，都需要涉及網站管理員，並且可導致資訊洩漏、拒絕服務，甚至危害受影響的系統。

Unix および Linux 用の無料の FTP サーバーである ProFTPD が、リモートホストで使用されています。

バナーによると、リモートホストにインストールされているバージョンの ProFTPD は、複数のフォーマット文字列脆弱性の影響を受けます（1 つは「ftpshut 」ユーティリティに関係し、もう 1 つは mod_sql の「SQLShowInfo」ディレクティブにあります）。このいずれかを悪用するには、一部のサイト管理者の側での関与が必要であり、情報漏洩、サービス拒否、および影響を受けるシステムのセキュリティ侵害すら引き起こすことがあります。

远程主机正在使用 ProFTPD，一款用于 Unix 和 Linux 的免费 FTP 服务器。

根据其标题，远程主机上安装的 ProFTPD 版本会遭受多种格式字符串漏洞的攻击，一种涉及“ftpshut”实用工具，另一种在 mod_sql 的“SQLShowInfo”指令中。利用任意一种都需涉及站点管理员并可导致信息泄露、拒绝服务，甚至破坏受影响的系统。

The remote host is using ProFTPD, a free FTP server for Unix and Linux.

According to its banner, the version of ProFTPD installed on the remote host suffers from multiple format string vulnerabilities, one involving the 'ftpshut' utility and the other in mod_sql's 'SQLShowInfo' directive. Exploitation of either requires involvement on the part of a site administrator and can lead to information disclosure, denial of service, and even a compromise of the affected system.

The remote host is affected by the vulnerability described in GLSA-200508-02 (ProFTPD: Format string vulnerabilities)

     'infamous42md' reported that ProFTPD is vulnerable to format     string vulnerabilities when displaying a shutdown message containing     the name of the current directory, and when displaying response     messages to the client using information retrieved from a database     using mod_sql.
  Impact :

    A remote attacker could create a directory with a malicious name     that would trigger the format string issue if specific variables are     used in the shutdown message, potentially resulting in a Denial of     Service or the execution of arbitrary code with the rights of the user     running the ProFTPD server. An attacker with control over the database     contents could achieve the same result by introducing malicious     messages that would trigger the other format string issue when used in     server responses.
  Workaround :

    Do not use the '%C', '%R', or '%U' in shutdown messages, and do     not set the 'SQLShowInfo' directive.

Two format string vulnerabilities were discovered in ProFTPD. The first exists when displaying a shutdown message containin the name of the current directory. This could be exploited by a user who creates a directory containing format specifiers and sets the directory as the current directory when the shutdown message is being sent.

The second exists when displaying response messages to the cleint using information retreived from a database using mod_sql. Note that mod_sql support is not enabled by default, but the contrib source file has been patched regardless.

The updated packages have been patched to correct these problems.

infamous42md reported that proftpd suffers from two format string vulnerabilities. In the first, a user with the ability to create a directory could trigger the format string error if there is a proftpd shutdown message configured to use the '%C', '%R', or '%U' variables.
In the second, the error is triggered if mod_sql is used to retrieve messages from a database and if format strings have been inserted into the database by a user with permission to do so.

The remote host is using ProFTPD, a free FTP server for Unix and Linux.  According to its banner, the version of ProFTPD installed on the remote host suffers from multiple format string vulnerabilities, one involving the 'ftpshut' utility and the other in mod_sql's 'SQLShowInfo' directive.  Exploitation of either requires involvement on the part of a site administrator and can lead to information disclosure, denial of service, and even a compromise of the affected system.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
21507	FreeBSD : proftpd -- format string vulnerabilities (c28f4705-043f-11da-bc08-0001020eed82)	Nessus	FreeBSD Local Security Checks	2006/5/13	2021/1/6	medium
19302	ProFTPD < 1.3.0rc2 多個遠端格式字串	Nessus	FTP	2005/7/27	2018/7/25	medium
19302	ProFTPD < 1.3.0rc2 の複数リモートフォーマット文字列	Nessus	FTP	2005/7/27	2018/7/25	medium
19302	ProFTPD < 1.3.0rc2 多种远程格式字符串	Nessus	FTP	2005/7/27	2018/7/25	medium
19302	ProFTPD < 1.3.0rc2 Multiple Remote Format Strings	Nessus	FTP	2005/7/27	2018/7/25	medium
19364	GLSA-200508-02 : ProFTPD: Format string vulnerabilities	Nessus	Gentoo Local Security Checks	2005/8/2	2021/1/6	medium
19897	Mandrake Linux Security Advisory : proftpd (MDKSA-2005:140)	Nessus	Mandriva Local Security Checks	2005/10/5	2021/1/6	medium
19565	Debian DSA-795-2 : proftpd - potential code execution	Nessus	Debian Local Security Checks	2005/9/6	2021/1/4	medium
3113	ProFTPD < 1.3.0rc2 Multiple Format Strings	Nessus Network Monitor	FTP Servers	2005/7/26	2019/3/6	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

high