<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Fail of PCI / DSS compliance<br>
<br>
Description: possible vulnerability in ProFTP 1.3.3e
Severity: Area of Concern
CVE: <a class="test" target="_blank"
href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4130">CVE-2011-4130</a>
Impact: Attackers exploiting these vulnerabilities may be able to
execute arbitrary commands, perhaps<span style=""> with root
privileges,
gain unauthorized access, or disrupt service on a target system.
Resolution
Upgrade [<a class="test" href="http://www.proftpd.org">http://www.proftpd.org</a>]
ProFTPD to version
[<a class="test"
href="http://www.proftpd.org/docs/RELEASE_NOTES-1.3.3g">http://www.proftpd.org/docs/RELEASE_NOT
ES-1.3.3g</a>] 1.3.3g
(stable) or greater.
Please see the ProFTPD Project's general instructions on
[<a class="test"
href="http://www.proftpd.org/docs/howto/Upgrade.html">http://www.proftpd.org/docs/howto/Upgra
de.html</a>] upgrading the software.
If your copy of the ProFTPD server daemon is part of
a larger software distribution,
check with your software vendor for a newer or patched version.
All FTP server processes must run as root,
at least during some parts of their operation,
in order to bind to the reserved low-numbered network ports
that are specified in the
[<a class="test" href="http://tools.ietf.org/html/rfc959">http://tools.ietf.org/html/rfc959</a>]
FTP standard.
The ProFTPD Project reminds administrators that, for greater
security,
the server should be configured to
[<a class="test"
href="http://www.proftpd.org/docs/howto/ConfigFile.html#Identity">http://www.proftpd.org/docs/howto/Confi
gFile.html#Identity</a>] run under an unprivileged user ID
at all times when root privileges are not essential.
Administrators with even stronger security requirements may want
to
configure the server to
[<a class="test"
href="http://www.proftpd.org/docs/howto/Nonroot.html">http://www.proftpd.org/docs/howto/Nonro
ot.html</a>] run entirely without root privileges,
at the cost of some inconvenience.
In some cases, disallowing anonymous ftp access, or removing
write permissions from all directories accessible by
anonymous ftp could serve as a workaround. However, this will
only be an effective <b>Solution</b> for those vulnerabilities
which,
as noted above, require the attacker to create files or
directories
on the server. You will still need to upgrade ProFTPD to
fix the other vulnerabilities.
Finally, ftp access can be restricted by using
[<a class="moz-txt-link-freetext" href="ftp://coast.cs.purdue.edu/pub/tools/unix">ftp://coast.cs.purdue.edu/pub/tools/unix</a> /netutils/tcp_wrappers]
TCP wrappers.
Vulnerability Details: Service: ftp
Received: 220 ProFTPD 1.3.3e Server (ProFTPD server)<br>
<br>
<br>
Thanks in advance for any help<br>
RC<br>
<br>
</span><span style="color: rgb(47, 69, 92); font-size: 10px; cursor:
pointer;"
onclick="this.previousSibling.previousSibling.style.display='none';
this.previousSibling.style.display=''; this.style.display='none';"></span>
<pre class="moz-signature" cols="72">
</pre>
</body>
</html>