[Secure-testing-team] Re: proftpd, low impact DoS bug

[Stefan Fritsch]

Hi,

On Tue, 28 Nov 2006, Moritz Muehlenhoff wrote:
> We have two different issues here:

AIUI, we have three different issues.

> A denial of service vulnerability discovered by Ralf Engelschall. That's
> what we've fixed so far. It's tracked as CVE-2006-5815 by several
> distributions by now. Although it's not suitable for code injection, it's
> still a DoS vulnerability.

This is the CommandBufferSize issue, I think. This was fixed by -13 and 
the DSA. I don't know why this was called CVE-2006-5815. The proftpd 
people don't think it is severe [1].

>
> The sreplace() issue.

This is the original CVE-2006-5815, but no info was available for weeks. 
Existance was announced on Nov 6, disclosure of info was on Nov 27. [1]

Then there is a third issue in mod_tls, in tls_x509_name_oneline(). 
Disclosure was on Nov 28. [2] I assumed that mod_tls was not enabled by 
default, so I set the severity to medium in the tracker. If mod_tls is on 
by default, it is of course 'high'.

Cheers,
Stefan


[1] http://bugs.proftpd.org/show_bug.cgi?id=2858
[2] http://seclists.org/bugtraq/2006/Nov/0549.html