ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) modsqlmysql and (2) modsqlpostgres.

A heap-based buffer overflow flaw was found in the way ProFTPD FTP server prepared SQL queries for certain usernames, when the modsql module was enabled. A remote, unauthenticated attacker could use this flaw to cause proftpd daemon to crash or, potentially, to execute arbitrary code with the privileges of the user running 'proftpd' via a specially-crafted username, provided in the authentication dialog.

Upstream bug report: [1] http://bugs.proftpd.org/showbug.cgi?id=3536

References: [2] http://www.securityfocus.com/bid/44933 [3] http://phrack.org/issues.html?issue=67&id=7#article [4] http://bugs.gentoo.org/showbug.cgi?id=348998 [5] http://proftpd.org/docs/RELEASENOTES-1.3.3d (ProFTPD v1.3.3d release notes)

CVE identifier: [6] http://www.openwall.com/lists/oss-security/2011/01/14/6