ProFTPD Mod_Radius Buffer Overflow Vulnerability

Bugtraq ID:	16535
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 07 2006 12:00AM
Updated:	Feb 07 2006 12:00AM
Credit:	Martin Loewer <[email protected]> reported this issue to the vendor.
Vulnerable:	ProFTPD Project ProFTPD 1.3 .0rc2 ProFTPD Project ProFTPD 1.3 .0rc1 ProFTPD Project ProFTPD 1.2.10 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 ProFTPD Project ProFTPD 1.2.9 rc3 ProFTPD Project ProFTPD 1.2.9 rc2 ProFTPD Project ProFTPD 1.2.9 rc1 ProFTPD Project ProFTPD 1.2.9 + Mandriva Linux Mandrake 10.0 + OpenPKG OpenPKG 2.0 + OpenPKG OpenPKG 1.3 + OpenPKG OpenPKG Current + Slackware Linux 9.1 + Slackware Linux 9.0 + Slackware Linux 8.1 + Slackware Linux -current ProFTPD Project ProFTPD 1.2.8 rc2 ProFTPD Project ProFTPD 1.2.8 rc1 ProFTPD Project ProFTPD 1.2.8 + Slackware Linux 9.0 + Slackware Linux 8.1 + Slackware Linux -current ProFTPD Project ProFTPD 1.2.7 rc3 ProFTPD Project ProFTPD 1.2.7 rc2 ProFTPD Project ProFTPD 1.2.7 rc1 ProFTPD Project ProFTPD 1.2.7 + Sun Cobalt Qube 3 ProFTPD Project ProFTPD 1.2.6 ProFTPD Project ProFTPD 1.2.5 rc1 ProFTPD Project ProFTPD 1.2.5 ProFTPD Project ProFTPD 1.2.4 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 ProFTPD Project ProFTPD 1.2.3 ProFTPD Project ProFTPD 1.2.2 rc3 ProFTPD Project ProFTPD 1.2.2 rc1 ProFTPD Project ProFTPD 1.2.2 ProFTPD Project ProFTPD 1.2.1 ProFTPD Project ProFTPD 1.2 pre9 ProFTPD Project ProFTPD 1.2 pre8 ProFTPD Project ProFTPD 1.2 pre7 ProFTPD Project ProFTPD 1.2 pre6 ProFTPD Project ProFTPD 1.2 pre5 ProFTPD Project ProFTPD 1.2 pre4 ProFTPD Project ProFTPD 1.2 pre3 ProFTPD Project ProFTPD 1.2 pre2 ProFTPD Project ProFTPD 1.2 pre11 ProFTPD Project ProFTPD 1.2 pre10 ProFTPD Project ProFTPD 1.2 pre1 ProFTPD Project ProFTPD 1.2 .0rc3 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 ProFTPD Project ProFTPD 1.2 .0rc2 ProFTPD Project ProFTPD 1.2 .0rc1 ProFTPD Project ProFTPD 1.2 + Cobalt Qube 3.0 + Cobalt Qube 2.0 + Cobalt RaQ 3.0 + Cobalt RaQ 2.0 + Cobalt RaQ 1.1
Not Vulnerable:	ProFTPD Project ProFTPD 1.3 rc3

ProFTPD Mod_Radius Buffer Overflow Vulnerability

ProFTPD's mod_radius is prone to a buffer-overflow vulnerability. This issue is due to a failure in the application to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Remote code execution may be possible, but it depends on an attacker's ability to brute-force the resulting output of an MD5 hash to place useful information into critical memory regions that are adjacent to the overrun stack buffer.

ProFTPD Mod_Radius Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ProFTPD Mod_Radius Buffer Overflow Vulnerability

Solution:
The vendor has released an updated version addressing this issue:


ProFTPD Project ProFTPD 1.2 .0rc3

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre4

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre5

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 .0rc1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre8

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre11

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre6

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre9

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 .0rc2

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre7

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre3

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre2

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2 pre10

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.10

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.2 rc1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.2

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.2 rc3

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.3

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.4

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.5

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.5 rc1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.6

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.7 rc3

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.7 rc2

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.7 rc1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.7

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.8 rc1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.8

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.8 rc2

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.9

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.9 rc1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.9 rc3

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.2.9 rc2

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.3 .0rc2

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Project ProFTPD 1.3 .0rc1

• ProFTPD Project proftpd-1.3.0rc3.tar.bz2
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.3.0rc3.tar.bz2

ProFTPD Mod_Radius Buffer Overflow Vulnerability

References:

• Bugzilla Bug 2658 - Segfault in mod_radius when using long password (ProFTPD Project)
  
• ProFTPD 1.3.0rc3 News (ProFTPD Project)
  
• ProFTPD Home Page (ProFTPD)