FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-0542

This CVE name corresponds to:

Entered	Topic
2009-03-16	proftpd -- multiple sql injection vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-0542 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-0542
Phase	Assigned(20090212)

Description

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.

References

Source	Reference
BUGTRAQ	20090210 Another SQL injection in ProFTPd with mod_mysql (probably postgres as well)
BUGTRAQ	20090210 ProFTPd with mod_mysql Authentication Bypass Exploit
BUGTRAQ	20090210 Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well)
BUGTRAQ	20090211 Re: Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well)
MILW0RM	8037
MLIST	[oss-security] 20090211 CVE request for proftpd
MLIST	[oss-security] 20090211 Re: CVE request for proftpd
MLIST	[oss-security] 20090211 Re: CVE request for proftpd
CONFIRM	http://bugs.proftpd.org/show_bug.cgi?id=3180
DEBIAN	DSA-1730
GENTOO	GLSA-200903-27
MANDRIVA	MDVSA-2009:061
SECUNIA	34268