Ubuntu 8.04.4 LTS - Proftpd SQL exploit

[Martin Malmgren]

Proftpd version 1.3.1-6ubuntu1 exploit:

The variable substitution feature in the version of ProFTPD running on the remote host can be abused to conduct a SQL injection attack. For example, a remote attacker can bypass authentication using a specially crafted username containing a percent sign character ('%'), a single quote, and SQL code.

http://www.securityfocus.com/archive/1/500823/30/0/threaded

http://bugs.proftpd.org/show_bug.cgi?id=3124

http://bugs.proftpd.org/show_bug.cgi?id=3180

http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2rc3
http://www.proftpd.org/docs/NEWS-1.3.2rc3

http://comments.gmane.org/gmane.comp.security.oss.general/1489

Solution: Upgrade to ProFTPD 1.3.2rc3 or later.

Could this be fixed in Ubuntu 8.04.4 LTS?

[Marc Deslauriers (mdeslaur)]

Lucid currently contains proftpd 1.3.2c-1ubuntu0.1, so it isn't vulnerable to this issue.

[Martin Malmgren (martin-malmgren)]

I know. Isn't 8.04.4 supported until April 2013?

[Marc Deslauriers (mdeslaur)]

Oh, sorry about that, I had misread that as 10.04 for some reason.

Since proftpd-dfsg is in universe, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

Although we don't track universe packages for 8.04 in our CVE tracker any longer, if a debdiff is submitted, we will sponsor it and get it uploaded to 8.04.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. hardy has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against hardy is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.