net-ftp/pure-ftpd-1.0.54 — Security Advisories

▸ GLSA 202003-54 Pure-FTPd: Multiple vulnerabilities this version unaffected low remote 2020-03-25

Multiple vulnerabilities have been found in Pure-FTPd, the worst of which could allow remote attackers to cause a Denial of Service condition.

Announced: 2020-03-25
Revised: 2020-03-25
Access: remote
Bugs: #711124
Advisory: https://security.gentoo.org/glsa/202003-54

Affected packages

Package	Arch	Vulnerable	Unaffected
net-ftp/pure-ftpd	*	< 1.0.49-r2	>= 1.0.49-r2

Background

Pure-FTPd is a fast, production-quality and standards-compliant FTP server.

Description

Multiple vulnerabilities have been discovered in Pure-FTPd. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly cause a Denial of Service condition or cause an information disclosure.

Workaround

There is no known workaround at this time.

Resolution

All Pure-FTPd users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-ftp/pure-ftpd-1.0.49-r2"

References

▸ GLSA 201110-25 Pure-FTPd: Multiple vulnerabilities this version unaffected normal remote 2011-10-26

Multiple vulnerabilities were found in Pure-FTPd allowing attackers to inject FTP commands or cause a Denial of Service.

Announced: 2011-10-26
Revised: 2011-10-26
Access: remote
Bugs: #358375 #365751
Advisory: https://security.gentoo.org/glsa/201110-25

Affected packages

Package	Arch	Vulnerable	Unaffected
net-ftp/pure-ftpd	*	< 1.0.32	>= 1.0.32

Background

Pure-FTPd is a fast, production-quality and standards-compliant FTP server.

Description

Multiple vulnerabilities have been discovered in Pure-FTPd. Please review the CVE identifiers referenced below for details.

Impact

Remote unauthenticated attackers may be able to inject FTP commands or cause a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All pure-ftpd users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-ftp/pure-ftpd-1.0.32"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since May 14, 2011. It is likely that your system is already no longer affected by this issue.

References

▸ GLSA 200407-04 Pure-FTPd: Potential DoS when maximum connections is reached this version unaffected normal remote 2004-07-04

Pure-FTPd contains a bug potentially allowing a Denial of Service attack when the maximum number of connections is reached.

Announced: 2004-07-04
Revised: 2006-05-22 (revision 2)
Access: remote
Bugs: #54590
Advisory: https://security.gentoo.org/glsa/200407-04

Affected packages

Package	Arch	Vulnerable	Unaffected
net-ftp/pure-ftpd	*	<= 1.0.18	>= 1.0.18-r1

Background

Pure-FTPd is a fast, production-quality and standards-compliant FTP server.

Description

Pure-FTPd contains a bug in the accept_client function handling the setup of new connections.

Impact

When the maximum number of connections is reached an attacker could exploit this vulnerability to perform a Denial of Service attack.

Workaround

There is no known workaround at this time. All users are encouraged to upgrade to the latest available version.

Resolution

All Pure-FTPd users should upgrade to the latest stable version:

# emerge sync

# emerge -pv ">=net-ftp/pure-ftpd-1.0.18-r1"
# emerge ">=net-ftp/pure-ftpd-1.0.18-r1"