CVE-2009-0543: SQL Injection
ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) modsqlmysql and (2) modsqlpostgres.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable NLS support in the ProFTPD configuration (turn off NLS support) to prevent bypass of SQL injection protections via invalid encoded multibyte characters.
ProFTPD NLS support = disabled - Configuration
Disable the mod_sql_mysql module (set enabled to false or remove module from configuration) if MySQL-based SQL authentication/authorization is not required, to avoid exposure to SQL injection bypass via invalid encoded multibyte characters.
ProFTPD mod_sql_mysql enabled = false - Configuration
Disable the mod_sql_postgres module (set enabled to false or remove module from configuration) if PostgreSQL-based SQL authentication/authorization is not required, to avoid exposure to SQL injection bypass via invalid encoded multibyte characters.
ProFTPD mod_sql_postgres enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0543?
CVE-2009-0543 is considered a moderate severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2009-0543?
To fix CVE-2009-0543, you should upgrade ProFTPD to version 1.3.2 or later, which addresses the issue.
What software is affected by CVE-2009-0543?
CVE-2009-0543 specifically affects ProFTPD Server version 1.3.1 with NLS support enabled.
What types of attacks are possible due to CVE-2009-0543?
CVE-2009-0543 allows remote attackers to bypass SQL injection protections, potentially leading to unauthorized data access.
Is CVE-2009-0543 a client-side or server-side vulnerability?
CVE-2009-0543 is a server-side vulnerability that affects the handling of multibyte characters in ProFTPD.