ID de Prueba:	1.3.6.1.4.1.25623.1.0.63630
Categoría:	FreeBSD Local Security Checks
Título:	FreeBSD Ports: proftpd, proftpd-mysql
Resumen:	The remote host is missing an update to the system; as announced in the referenced advisory.
Descripción:	Summary: The remote host is missing an update to the system as announced in the referenced advisory. Vulnerability Insight: The following packages are affected: proftpd proftpd-mysql proftpd-devel CVE-2009-0542 SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a '%' (percent) character in the username, which introduces a ''' (single quote) character during variable substitution by mod_sql. CVE-2009-0543 ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres. Solution: Update your system with the appropriate patches or software upgrades. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0542 Bugtraq: 20090210 Another SQL injection in ProFTPd with mod_mysql (probably postgres as well) (Google Search) http://www.securityfocus.com/archive/1/500823/100/0/threaded Bugtraq: 20090210 ProFTPd with mod_mysql Authentication Bypass Exploit (Google Search) http://www.securityfocus.com/archive/1/500851/100/0/threaded Bugtraq: 20090210 Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well) (Google Search) http://www.securityfocus.com/archive/1/500833/100/0/threaded Bugtraq: 20090211 Re: Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well) (Google Search) http://www.securityfocus.com/archive/1/500852/100/0/threaded Debian Security Information: DSA-1730 (Google Search) http://www.debian.org/security/2009/dsa-1730 https://www.exploit-db.com/exploits/8037 http://security.gentoo.org/glsa/glsa-200903-27.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:061 http://www.openwall.com/lists/oss-security/2009/02/11/1 http://www.openwall.com/lists/oss-security/2009/02/11/3 http://www.openwall.com/lists/oss-security/2009/02/11/5 http://secunia.com/advisories/34268 Common Vulnerability Exposure (CVE) ID: CVE-2009-0543 http://www.openwall.com/lists/oss-security/2009/02/11/4
Copyright	Copyright (C) 2009 E-Soft Inc.

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.