Test ID:	1.3.6.1.4.1.25623.1.0.70559
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 2346-1 (proftpd-dfsg)
Summary:	The remote host is missing an update to proftpd-dfsg announced via advisory DSA 2346-1.;; This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-2346)' (OID: 1.3.6.1.4.1.25623.1.0.70560).
Description:	Summary: The remote host is missing an update to proftpd-dfsg announced via advisory DSA 2346-1. This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-2346)' (OID: 1.3.6.1.4.1.25623.1.0.70560). Vulnerability Insight: Several vulnerabilities were discovered in ProFTPD, an FTP server: ProFTPD incorrectly uses data from an unencrypted input buffer after encryption has been enabled with STARTTLS, an issue similar to CVE-2011-0411. CVE-2011-4130 ProFTPD uses a response pool after freeing it under exceptional conditions, possibly leading to remote code execution. (The version in lenny is not affected by this problem.) For the oldstable distribution (lenny), this problem has been fixed in version 1.3.1-17lenny8. For the stable distribution (squeeze), this problem has been fixed in version 1.3.3a-6squeeze4. For the testing distribution (wheezy) and the unstable distribution (sid), this problem has been fixed in version 1.3.4~ rc3-2. Solution: We recommend that you upgrade your proftpd-dfsg packages. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4130 50631 http://www.securityfocus.com/bid/50631 http://bugs.proftpd.org/show_bug.cgi?id=3711 http://www.proftpd.org/docs/NEWS-1.3.3g http://www.zerodayinitiative.com/advisories/ZDI-11-328/ Common Vulnerability Exposure (CVE) ID: CVE-2011-0411 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html BugTraq ID: 46767 http://www.securityfocus.com/bid/46767 CERT/CC vulnerability note: VU#555316 http://www.kb.cert.org/vuls/id/555316 Debian Security Information: DSA-2233 (Google Search) http://www.debian.org/security/2011/dsa-2233 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056560.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056559.html http://security.gentoo.org/glsa/glsa-201206-33.xml http://www.openwall.com/lists/oss-security/2021/08/10/2 http://www.osvdb.org/71021 http://www.redhat.com/support/errata/RHSA-2011-0422.html http://www.redhat.com/support/errata/RHSA-2011-0423.html http://securitytracker.com/id?1025179 http://secunia.com/advisories/43646 http://secunia.com/advisories/43874 SuSE Security Announcement: SUSE-SR:2011:009 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://www.vupen.com/english/advisories/2011/0611 http://www.vupen.com/english/advisories/2011/0752 http://www.vupen.com/english/advisories/2011/0891 XForce ISS Database: multiple-starttls-command-execution(65932) https://exchange.xforce.ibmcloud.com/vulnerabilities/65932
Copyright	Copyright (C) 2012 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.