Ubuntu 24.10: 7297-1 Critical: ProFTPD Privilege Escalation Issues

ubuntu

February 25, 2025

Several security issues were fixed in proftpd-dfsg.

Summary

Several security issues were fixed in proftpd-dfsg.

Software Description:

- proftpd-dfsg: Versatile, virtual-hosting FTP daemon

Details:

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that the

transport protocol implementation in ProFTPD had weak integrity checks.

An attacker could use this vulnerability to bypass security features

like encryption and integrity checks. (CVE-2023-48795)

Martin Mirchev discovered that ProFTPD did not properly validate user

input over the network. An attacker could use this vulnerability to

crash ProFTPD or execute arbitrary code. (CVE-2023-51713)

Brian Ristuccia discovered that ProFTPD incorrectly inherited groups

from the parent process. An attacker could use this vulnerability to

elevate privileges. (CVE-2024-48651)

Topics Covered

security advisory security issue critical software update privilege escalation security fix doS proftpd ubuntu elevation of privilege proftpd-dfsg

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
   proftpd-core                    1.3.8.b+dfsg-2ubuntu1.24.10.1

Ubuntu 24.04 LTS
   proftpd-core                    1.3.8.b+dfsg-1ubuntu0.1

Ubuntu 22.04 LTS
   proftpd-basic                   1.3.7c+dfsg-1ubuntu0.1
   proftpd-core                    1.3.7c+dfsg-1ubuntu0.1

Ubuntu 20.04 LTS
   proftpd-basic                   1.3.6c-2ubuntu0.1

In general, a standard system update will make all the necessary changes.