ProFTPD mod_sqlpw Vulnerability

Bugtraq ID:	812
Class:	Design Error
CVE:	CVE-1999-1475
Remote:	No
Local:	Yes
Published:	Nov 19 1999 12:00AM
Updated:	Jul 11 2009 12:56AM
Credit:	First posted to BugTraq by Todd C. Campbell <[email protected]> on Nov 19, 1999.
Vulnerable:	ProFTPD Project ProFTPD 1.2.1 ProFTPD Project ProFTPD 1.2 pre9 ProFTPD Project ProFTPD 1.2 pre8 ProFTPD Project ProFTPD 1.2 pre7 ProFTPD Project ProFTPD 1.2 pre6 ProFTPD Project ProFTPD 1.2 pre5 ProFTPD Project ProFTPD 1.2 pre4 ProFTPD Project ProFTPD 1.2 pre3 ProFTPD Project ProFTPD 1.2 pre2 ProFTPD Project ProFTPD 1.2 pre11 ProFTPD Project ProFTPD 1.2 pre10 ProFTPD Project ProFTPD 1.2 pre1 ProFTPD Project ProFTPD 1.2 .0rc3 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 ProFTPD Project ProFTPD 1.2 + Cobalt Qube 3.0 + Cobalt Qube 2.0 + Cobalt RaQ 3.0 + Cobalt RaQ 2.0 + Cobalt RaQ 1.1
Not Vulnerable:

ProFTPD mod_sqlpw Vulnerability

ProFTPD is a popular FTP server that ships with numerous Unix and Linux variants.

Compiling the mod_sqlpw module into ProFTPD makes it possible for local users to view the passwords of users who have connected to the ftp server. When the module is used, it writes information to wtmp. Unfortunately, it writes the password to wtmp where the username should be. The passwords can be seen when a command such as 'last' is used locally.

ProFTPD mod_sqlpw Vulnerability

Solution:
Upgrades are available.


ProFTPD Project ProFTPD 1.2 pre3

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre1

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre2

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre9

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 .0rc3

• Conectiva proftpd-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/proftpd-1.2.5rc1-1U50_1cl .i386.rpm


• Conectiva proftpd-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/proftpd -1.2.5rc1-1U50_1cl.i386.rpm


• Conectiva proftpd-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/proftpd- 1.2.5rc1-1U50_1cl.i386.rpm


• Conectiva proftpd-1.2.5rc1-1U51_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/proftpd-1.2.5rc1-1U51_1cl .i386.rpm


• Conectiva proftpd-1.2.5rc1-1U60_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/proftpd-1.2.5rc1-1U60_1cl .i386.rpm


• Conectiva proftpd-1.2.5rc1-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/proftpd-1.2.5rc1-1U70_1cl .i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U50_1cl.i386.rpm
  


• Conectiva proftpd-doc-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/proftpd-doc-1.2.5rc1-1U50 _1cl.i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/proftpd- doc-1.2.5rc1-1U50_1cl.i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U51_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/proftpd-doc-1.2.5rc1-1U51 _1cl.i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U60_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/proftpd-doc-1.2.5rc1-1U60 _1cl.i386.rpm


• Conectiva proftpd-doc-1.2.5rc1-1U70_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/proftpd-doc-1.2.5rc1-1U70 _1cl.i386.rpm


• Mandrake proftpd-1.2.5-0.rc1.1.2mdk.i586.rpm
  Mandrake Linux 7.2 i586 upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake proftpd-1.2.5-0.rc1.1mdk.i586.rpm
  Mandrake Linux 8.0 i586 upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake proftpd-1.2.5-0.rc1.1mdk.i586.rpm
  Mandrake Linux 8.1 i586 upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake proftpd-1.2.5-0.rc1.1mdk.ppc.rpm
  Mandrake Linux 8.0 PPC upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• Mandrake proftpd-1.2.5-0.rc1.2mdk.ia64.rpm
  Mandrake Linux 8.1 IA64 upgrade.
  http://www.linux-mandrake.com/en/ftp.php3


• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre4

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre5

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre8

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre11

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre7

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre6

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2 pre10

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz

ProFTPD Project ProFTPD 1.2.1

• ProFTPD Project proftpd-1.2.4.tar.gz
  ftp://ftp.proftpd.org/distrib/source/proftpd-1.2.4.tar.gz