REDHAT-BUG-530719: Low severity proftpd vulnerability
modtls.c in ProFTPD 1.3.2a does not properly handle a '\0' character in a domain name in the subject's alternative name (subjectAltName) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Upstream bug report: -------------------- http://bugs.proftpd.org/showbug.cgi?id=3275
Upstream patch: --------------- http://bugs.proftpd.org/attachment.cgi?id=3096
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-530719?
The severity of REDHAT-BUG-530719 is high due to its potential exploitation for man-in-the-middle attacks.
How do I fix REDHAT-BUG-530719?
To fix REDHAT-BUG-530719, update ProFTPD to the latest version that addresses this vulnerability.
Which versions of ProFTPD are affected by REDHAT-BUG-530719?
ProFTPD versions prior to the fix for REDHAT-BUG-530719 are affected.
Can REDHAT-BUG-530719 be exploited remotely?
Yes, REDHAT-BUG-530719 can be exploited remotely by attackers through a crafted X.509 certificate.
What type of attack does REDHAT-BUG-530719 allow?
REDHAT-BUG-530719 allows man-in-the-middle attackers to spoof arbitrary SSL servers.