Facebook
TwitterHi Parallels-Team!
Plesk 10 comes with ProFTPD v 1.3.3 (psa-proftpd-1.3.3-cos5.build109101020.08.x86_64 : ProFTPD -- Professional FTP Server). Unfortunately this version has a critical security issue. See http://www.h-online.com/security/news/item/Security-update-for-ProFTPD-FTP-server-1128907.html and http://bugs.proftpd.org/show_bug.cgi?id=3521:
------------------ begin snippet ---------------------
Security update for ProFTPD FTP server
A flaw in the popular ProFTPD FTP server potentially allows unauthenticated attackers to compromise a server. The problem is caused by a buffer overflow in the pr_netio_telnet_gets() function for evaluating TELNET IAC sequences.
ProFTPD is capable of processing TELNET IAC sequences on port 21; the sequences enable or disable certain options not supported by the Telnet or FTP protocol itself. The buffer overflow allows attackers to write arbitrary code to the application's stack and launch it. Updating to version 1.3.3c of ProFTPD solves the problem.
The update also fixes a directory traversal vulnerability which can only be exploited if the "mod_site_misc" module is loaded. This flaw could allow attackers with write privileges to leave their permitted path and delete directories or create symbolic links outside of the path. The module is not loaded or compiled by default.
Further information about the update can be found in the release notes and in the NEWS file. As the developers have classified the release as an "important security update", all users are advised to install it as soon as possible.
------------------- endsnippet ----------------------
To fix the issue ProFTPD 1.3.3c was released.
When will Parallels provide the neccessary update for Plesk 10? Or do we have to patch ProFTPD bei ourself? For which Plesk version you´ll provide a fix?!?
Thanks!
Plesk 10 comes with ProFTPD v 1.3.3 (psa-proftpd-1.3.3-cos5.build109101020.08.x86_64 : ProFTPD -- Professional FTP Server). Unfortunately this version has a critical security issue. See http://www.h-online.com/security/news/item/Security-update-for-ProFTPD-FTP-server-1128907.html and http://bugs.proftpd.org/show_bug.cgi?id=3521:
------------------ begin snippet ---------------------
Security update for ProFTPD FTP server
A flaw in the popular ProFTPD FTP server potentially allows unauthenticated attackers to compromise a server. The problem is caused by a buffer overflow in the pr_netio_telnet_gets() function for evaluating TELNET IAC sequences.
ProFTPD is capable of processing TELNET IAC sequences on port 21; the sequences enable or disable certain options not supported by the Telnet or FTP protocol itself. The buffer overflow allows attackers to write arbitrary code to the application's stack and launch it. Updating to version 1.3.3c of ProFTPD solves the problem.
The update also fixes a directory traversal vulnerability which can only be exploited if the "mod_site_misc" module is loaded. This flaw could allow attackers with write privileges to leave their permitted path and delete directories or create symbolic links outside of the path. The module is not loaded or compiled by default.
Further information about the update can be found in the release notes and in the NEWS file. As the developers have classified the release as an "important security update", all users are advised to install it as soon as possible.
------------------- endsnippet ----------------------
To fix the issue ProFTPD 1.3.3c was released.
When will Parallels provide the neccessary update for Plesk 10? Or do we have to patch ProFTPD bei ourself? For which Plesk version you´ll provide a fix?!?
Thanks!
