SB2020011349 - OpenSUSE Linux update for proftpd

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2017-7418)

The vulnerability allows a local user to access sensitive information.

The vulnerability exists due to incorrect implementation of the AllowChrootSymlinks option that checks only the last path component when enforcing it. A local user with ability to manage own FTP home directory can create a specially crafted symbolic link and gain unauthorized access to the filesystem.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-12815)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the application does not honor <Limit READ> and <Limit WRITE> configurations for SITE CPFR and SITE CPTO commands in the mod_copy module. A remote authenticated user with read permissions (e.g. user anonymous) can read contents of an arbitrary file on the server.

3) Infinite loop (CVE-ID: CVE-2019-18217)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in main.c in a child process when handling overly long commands. A remote non-authenticated attacker can perform a denial of service attack by sending an overly log command to the affected FTP server.

4) NULL pointer dereference (CVE-ID: CVE-2019-19269)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference in tls_verify_crl() function in ProFTPD while processing data, returned by the OpenSSL sk_X509_REVOKED_value() function when encountering an empty CRL installed by a system administrator. A remote attacker can trigger the NULL pointer dereference error when validating the certificate of a client connecting to the server in a TLS client/server mutual-authentication setup.

Successful exploitation of the vulnerability will result in a denial of service condition.

5) Improper Certificate Validation (CVE-ID: CVE-2019-19270)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry (checking twice for subject, rather than once for subject and once for issuer) prevents some valid CRLs from being taken into account, and can allow clients whose certificates have been revoked to proceed with a connection to the server.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html