vulnerable to CVE-2007-2165

[fago]

Binary package hint: proftpd

http://secunia.com/cve_reference/CVE-2007-2165/

I was able to reproduce the problem with feisty's proftpd package.

This problem may even lead to remote code injection:
http://blog.syscp.org/archives/58-Security-warning-Possible-remote-code-injection-when-using-Debian-SargeEtch.html

Which is already used by attackers:
(sry, german) http://forum.hetzner.de/wbb2/thread.php?threadid=9278

[Hippu (teemu-heinamaki)]

Changing to confirmed since this is reported in debian and upstream.

[William Grant (wgrant)]

LP's release targetting mechanism is braindead. Business as usual.

[William Grant (wgrant)]

Fixed in 1.3.0-22, which is in Gutsy.

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[LumpyCustard (orangelumpycustard)]

Please close for Feisty as Won't Fix? This goes for all the other Feisty bugs.

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[rusivi2 (rusivi2-deactivatedaccount)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Regarding Dapper, please execute the following command, as it will automatically gather debugging information, in a terminal:
apport-collect BUGNUMBER
When reporting bugs in the future please use apport, using 'ubuntu-bug' and the name of the package affected. You can learn more about this functionality at https://wiki.ubuntu.com/ReportingBugs.

[Scott Kitterman (kitterman)]

This is a nonsense request. There is no apport in dapper.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.