URGENT: security fix for psa-proftpd?

[atomicturtle]

Its not the psa-proftpd package, its whatever is managing the xinetd config file in Plesk 10. Looks like the package name has changed between 9 and 10.

 

[JuergenW]

Igor, no answer !???? :-(((((

 

[IgorG]

Plesk Microupdate where this problem will be fixed will be released very soon.

 

[atomicturtle]

psa-proftpd 1.3.3c-2 has been released in the [atomic] repo to support Plesk 10 environments.

 

[horst rupp]

Plesk Microupdate where this problem will be fixed will be released very soon.

what is "very soon" in days?

 

[stupidnic]

I find it funny that the bug was raised on October 29th (with Proftpd), and presented here on November 1st, and here is it November 10th and Plesk still doesn't have a patch for an _unauthenticated_ remote exploit. Even more laughable is that a third party vendor (atomic) has had a patch out for this security exploit for over a week. There is an exploit in the wild specifically targeting Plesk installs that has been out for three days.

I found four servers that have already been compromised using this exploit. We have disabled FTP on all Debian Plesk machines to prevent further exploits (our CentOS machines already use the atomic repos and were already protected).

I have to wonder what exactly is the hold up here. If Plesk offered the source packages for Debian I would have already patched this myself a week ago (which they are required to provide under the GPL, but don't seem to offer anywhere - but that is another matter completely).

 

[horst rupp]

There is an exploit in the wild specifically targeting Plesk installs that has been out for three days.

the metasploit-module is 6 days old.

 

[stupidnic]

Yep, and the one released on full-disclosure specifically references Plesk:

 ["Debian GNU/Linux 5.0, ProFTPD 1.3.2e Server (Plesk binary)",
...
 ["Debian GNU/Linux 5.0, ProFTPD 1.3.3 Server (Plesk binary)",
...
 ["Debian GNU/Linux 4.0, ProFTPD 1.3.2e Server (Plesk binary)",
...
 ["SUSE Linux 9.3, ProFTPD 1.3.2e Server (Plesk binary)",
...
 ["SUSE Linux 10.0/10.3, ProFTPD 1.3.2e Server (Plesk binary)",
...
 ["SUSE Linux 10.2, ProFTPD 1.3.2e Server (Plesk binary)",
...
 ["SUSE Linux 11.0, ProFTPD 1.3.2e Server (Plesk binary)",
...
 ["SUSE Linux 11.1, ProFTPD 1.3.2e Server (Plesk binary)",
...
 ["SUSE Linux SLES 10, ProFTPD 1.3.2e Server (Plesk binary)",
...
 ["CentOS 5, ProFTPD 1.3.2e Server (Plesk binary)",
...

 

[HostaHost]

The Parallels announcement only mentions Plesk 9 and 10, are 8.x installs not vulnerable due to the older version of proftpd?

 

[stupidnic]

The problem according to the proftpd bugs database was introduced in version 1.3.2rc3 of ProFTPd. Looking at a Plesk 8.6 server I can see that the server is running ProFTPd verison 1.3.2e which would appear to be affected as well.

I am curious what Parallels will say about support for that version of Plesk.

 

[HostaHost]

Seems like the only platform not affected would be PSA 8 on CentOS 3 where the newest version was 8.4 and which came with psa-proftpd-1.3.1-cos3.build84080425.19. PSA 8 on CentOS 4 and CentOS 5 all use vulnerable versions.

 

[trialot]

UPDATE Solution

In my last post, I asked about the consequences of symlinking.

Still wanting some feedback, but some remarks, when using the "symlink solution with newly compiled proftpd":

A - ftpxxx tools
- /usr/bin directory has some ftpdxxxx files (ftpwho, ftpcount etc) in it,
- these files are "old" and will not work with the newer version of proftpd
- if desired (not necessary), symlink those files to the new files (in the compilation directory)

B - Modules
Standard compilation of the newer version of proftpd (just issuing ./configure without custom config file) does exclude some modules that are present in the psa-proftpd compilation.

As far as I can see, no harm in missing them, but the missing modules are:
- mod_tls
- mod_quota (in the newer version, presumably mod_quotatab)
- mod_readme
- mod_ratio

They can be found in the contrib folder of the proftpd source directory, just compile them in your own version of proftpd.

C - UNRESOLVED vulnerability: mod_site
Somehow, I do understand that the newer 1.3.3c version resolves the security issues, except for the mod_site vulnerability. Less severe, but still annoying.

Parallels, resolve that in a hotfix.

D - Post scriptum
If any reasonable compilation of proftpd results, I will give it to anybody who asks/mails.

Naturally, Parallels should be providing the hotfix and, in the meantime, hope I can help.

 

[Adam Mudie]

Am I Affected

Hey Guys

Are my servers afected?

[admin@au1-h1-b4-p1 ~]# proftpd -v
- ProFTPD Version 1.3.1
[admin@au1-h1-b4-p1 ~]# uname -a
Linux au1-h1-b4-p1 2.6.18-028stab060.8 #1 SMP Mon Feb 9 20:25:36 MSK 2009 x86_64 x86_64 x86_64 GNU/Linux
[root@au1-h1-b4-p1 ~]#

How can u upgrade with without yum?

I cant install atomic without yum..

Can someone give me step by step as i don't wanna break it

Cheers
Ryan

 

[EduardoG]

There is acritical bug and we have to wait 10 days for Parallels to release a hotfix, when official proftpd is already patched.

BTW, updating with atomic leads to another problem:

Determining the packages that need to be installed.
ERROR: Unable to proceed with the installation until the package psa-proftpd-1.3.3c-2.el5.art.x86_64 is removed from the system.
Not all packages were installed.

This is a terrible service from Parallels, is this what we have to expect from them? 10 days to fix a bug? Is that the price of the license?

 

[IgorG]

http://www.parallels.com/products/plesk/ProFTPD

 

[HostaHost]

http://www.parallels.com/products/plesk/ProFTPD

Why does your notice continue to ignore the fact that Plesk 8 is also vulnerable?

 

[IgorG]

Why does your notice continue to ignore the fact that Plesk 8 is also vulnerable?

Why do not want upgrade this very-very old Plesk version?

 

[ViktorT]

I have Debian Lenny where ist a Update for Debain lenny Plesk 9.5.3

 

[EduardoG]

What should we do if we applied atomic update? (as suggested at http://www.parallels.com/products/plesk/ProFTPD)

A Proftpd update for Plesk has been provided by Atomic Rocket Turtle. To apply the update, execute the commands below.

# wget -O - http://www.atomicorp.com/installers/atomic |sh
# yum upgrade psa-proftpd

This installs right, but leads to autoinstaller error:

ERROR: Unable to proceed with the installation until the package psa-proftpd-1.3.3c-2.el5.art.x86_64 is removed from the system.

Should I uninstall proftpd from all servers?

 

[IgorG]

I have Debian Lenny where ist a Update for Debain lenny Plesk 9.5.3

Autoinstaller Plesk 9.5.3 for Debian Lenny - http://www.parallels.com/download/plesk9/#debian