In the ProFTPD FTP server a dangerous vulnerability (), which allows files to be copied within the server without authentication using the commands 'site cpfr' and 'site cpto'. The issue a severity level of 9.8 out of 10, as it can be exploited for remote code execution if anonymous FTP access is provided.
The vulnerability incorrect access control checks for reading and writing data (Limit READ and Limit WRITE) in the mod_copy module, which is enabled by default and included in the proftpd packages for most distributions. Notably, the vulnerability results from a not fully resolved similar issue, in 2015, for which new attack vectors have now been identified. Moreover, the issue was reported to developers back in September of last year, but the patch was only released a few days ago.
The problem also manifests in the latest stable releases of ProFTPd 1.3.6 and 1.3.5d. A fix is available in the form of . As a workaround, it is recommended to disable mod_copy in the configuration. The vulnerability has currently been fixed only in and remains unfixed in , , , , (ProFTPD is not supplied in the main RHEL repository, and the package from EPEL-6 is not affected by the issue as it does not include mod_copy).
Source: opennet.ru
