Lucene search

MitreCVE-2009-0543

HistoryFeb 12, 2009 - 4:30 p.m.

CVE-2009-0543

2009-02-1216:30:00

CWE-89

mitre

web.nvd.nist.gov

293

proftpd

server

1.3.1

sql injection

bypass

vulnerability

nls

mod_sql_mysql

mod_sql_postgres

remote attackers

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

Low

EPSS

0.003

Percentile

71.7%

JSON

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.

Affected configurations

Nvd

Node

proftpdproftpdMatch1.3.1

VendorProductVersionCPE
proftpdproftpd1.3.1cpe:/a:proftpd:proftpd:1.3.1:::

Vendor	Product	Version	CPE
proftpd	proftpd	1.3.1	cpe:/a:proftpd:proftpd:1.3.1:::

References

bugs.proftpd.org/show_bug.cgi?id=3173

secunia.com/advisories/34268

security.gentoo.org/glsa/glsa-200903-27.xml

www.debian.org/security/2009/dsa-1730

www.mandriva.com/security/advisories?name=MDVSA-2009:061

www.openwall.com/lists/oss-security/2009/02/11/4

www.openwall.com/lists/oss-security/2009/02/11/5

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

Low

EPSS

0.003

Percentile

71.7%

JSON

Related for CVE-2009-0543