Chiwopsezo chachikulu mu ProFTPd

Mu seva ya ProFTPD ftp kudziwika chiwopsezo chowopsa (CVE-2019-12815), zomwe zimakulolani kukopera mafayilo mkati mwa seva popanda kutsimikiziridwa pogwiritsa ntchito malamulo a "site cpfr" ndi "site cpto". vuto kupatsidwa Mulingo wowopsa 9.8 mwa 10, chifukwa ukhoza kugwiritsidwa ntchito kukonza ma code akutali pomwe ukupereka mwayi wosadziwika wa FTP.

Chiwopsezo zidayambitsa cheke cholakwika cha zoletsa zofikira pakuwerenga ndi kulemba deta (Limit READ ndi Limit WRITE) mu mod_copy module, yomwe imagwiritsidwa ntchito mwachisawawa ndikuyatsidwa mumapaketi a proftpd pazogawa zambiri. Ndizofunikira kudziwa kuti kusatetezekako ndi chifukwa cha vuto lomwelo lomwe silinatheretu kwathunthu, kudziwika mu 2015, pomwe ma vectors atsopano adadziwika. Komanso, vutoli linanenedwa kwa omanga kumbuyo kwa September chaka chatha, koma chigambacho chinali okonzeka masiku angapo apitawo.

Vutoli likuwonekeranso m'mabuku aposachedwa a ProFTPd 1.3.6 ndi 1.3.5d. Kukonzekera kulipo ngati chigamba. Monga njira yachitetezo, tikulimbikitsidwa kuletsa mod_copy mu kasinthidwe. Chiwopsezocho chakhazikika mpaka pano Fedora ndipo amakhala wosakonzedwa Debian, SUSE/OpenSUSE, Ubuntu, FreeBSD, EPEL-7 (ProFTPD sichikuperekedwa m'malo akuluakulu a RHEL, ndipo phukusi lochokera ku EPEL-6 silimakhudzidwa ndi vutoli chifukwa silimaphatikizapo mod_copy).

Source: opennet.ru

Kuwonjezera ndemanga