Active8
Verified User
- Joined
- Jul 13, 2013
- Messages
- 1,770
I'm not sure of this is the right place but just saw this:
ProFTPd CVE-2019-12815
published 18.07.2019
ID: CVE-2019-12815
Title: ProFTPd mod_copy - arbitrary file copy without authentication
Release Date: 2019-07-18
Severity: Important
Overview:
Tobias Mädel has identified a vulnerability in ProFTPd's mod_copy. mod_copy is supplied in the default installation of ProFTPd and is enabled by default in most distributions (e.g. Debian).
Details:
1: CVE-2019-12815: mod_copy Incorrect Access Control
Description: Issueing CPFR, CPTO commands to a ProFTPd server allows users without write permissions to copy any file on the FTP server.
Fix: https://github.com/proftpd/proftpd/pull/816
Workaround #1: Disable mod_copy in the ProFTPd configuration file.
ProFTPd Bugtracker: http://bugs.proftpd.org/show_bug.cgi?id=4372
--------------------------------------------------------------------------------
Found a workaorund (not tested):
To disable mod_copy please follow the instructions below:
nano /etc/proftpd/modules.conf
Find the line that contains LoadModule mod_copy.c
Insert a '#' at the start of the line so that it reads #LoadModule mod_copy.c
Save the file
Restart proftpd
------------------------------------------------------------------------------
https://tbspace.de/cve201912815proftpd.html
EDIT:
New DA installations are shipped with PureFTP but old one where with ProFTPd
I have checked my config and could not find: LoadModule mod_copy.c
Probably DA does not build this as default, can someone from staff confirm this ?
ProFTPd CVE-2019-12815
published 18.07.2019
ID: CVE-2019-12815
Title: ProFTPd mod_copy - arbitrary file copy without authentication
Release Date: 2019-07-18
Severity: Important
Overview:
Tobias Mädel has identified a vulnerability in ProFTPd's mod_copy. mod_copy is supplied in the default installation of ProFTPd and is enabled by default in most distributions (e.g. Debian).
Details:
1: CVE-2019-12815: mod_copy Incorrect Access Control
Description: Issueing CPFR, CPTO commands to a ProFTPd server allows users without write permissions to copy any file on the FTP server.
Fix: https://github.com/proftpd/proftpd/pull/816
Workaround #1: Disable mod_copy in the ProFTPd configuration file.
ProFTPd Bugtracker: http://bugs.proftpd.org/show_bug.cgi?id=4372
--------------------------------------------------------------------------------
Found a workaorund (not tested):
To disable mod_copy please follow the instructions below:
nano /etc/proftpd/modules.conf
Find the line that contains LoadModule mod_copy.c
Insert a '#' at the start of the line so that it reads #LoadModule mod_copy.c
Save the file
Restart proftpd
------------------------------------------------------------------------------
https://tbspace.de/cve201912815proftpd.html
EDIT:
New DA installations are shipped with PureFTP but old one where with ProFTPd
I have checked my config and could not find: LoadModule mod_copy.c
Probably DA does not build this as default, can someone from staff confirm this ?
Last edited: