Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 690528 (CVE-2019-12815) - <net-ftp/proftpd-1.3.6-r5: file copy vulnerability in mod_copy allows for remote code execution (CVE-2019-12815)
Summary: <net-ftp/proftpd-1.3.6-r5: file copy vulnerability in mod_copy allows for rem...
Status: RESOLVED FIXED
Alias: CVE-2019-12815
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa+ cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-23 20:25 UTC by GLSAMaker/CVETool Bot
Modified: 2019-10-26 22:41 UTC (History)
1 user (show)

See Also:
Package list:
net-ftp/proftpd-1.3.6-r5
Runtime testing required: No
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2019-07-23 20:25:36 UTC 
CVE-2019-12815 (https://nvd.nist.gov/vuln/detail/CVE-2019-12815):
  An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b
  allows for remote code execution and information disclosure without
  authentication, a related issue to CVE-2015-3306.
Comment 1 Larry the Git Cow gentoo-dev 2019-07-24 06:40:52 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7a15285681e428f4d4800705b1561db599c3cf79

commit 7a15285681e428f4d4800705b1561db599c3cf79
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2019-07-24 06:40:13 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2019-07-24 06:40:45 +0000

    net-ftp/proftpd: fix mod_copy RCE, bug #690528
    
    Also known as CVE-2019-12815.
    
    Bug: https://bugs.gentoo.org/690528
    Package-Manager: Portage-2.3.69, Repoman-2.3.16
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 net-ftp/proftpd/files/proftpd-1.3.6-mod_copy.patch |  96 +++++++
 net-ftp/proftpd/proftpd-1.3.6-r5.ebuild            | 275 +++++++++++++++++++++
 2 files changed, 371 insertions(+)
Comment 2 Sergei Trofimovich (RETIRED) gentoo-dev 2019-07-24 06:48:14 UTC 
Arches, please stabilize
    =net-ftp/proftpd-1.3.6-r5
for the following target keywords:
    KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86"

Thanks!
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2019-07-24 20:51:12 UTC 
x86 stable
Comment 4 Agostino Sarubbo gentoo-dev 2019-07-25 13:06:51 UTC 
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2019-07-26 09:17:13 UTC 
ppc64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-07-26 09:52:44 UTC 
ppc stable
Comment 7 Rolf Eike Beer archtester 2019-07-26 18:41:45 UTC 
hppa/sparc stable
Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev 2019-07-27 07:10:03 UTC 
ia64 stable
Comment 9 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2019-07-28 20:21:17 UTC 
arm stable
Comment 10 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2019-07-28 20:21:37 UTC 
alpha stable
Comment 11 Aaron Bauman (RETIRED) gentoo-dev 2019-08-11 22:55:55 UTC 
@maintainer, please drop vulnerable.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2019-08-15 15:58:11 UTC 
This issue was resolved and addressed in
 GLSA 201908-16 at https://security.gentoo.org/glsa/201908-16
by GLSA coordinator Aaron Bauman (b-man).
Comment 13 Aaron Bauman (RETIRED) gentoo-dev 2019-08-15 15:58:36 UTC 
re-opened for cleanup
Comment 14 Larry the Git Cow gentoo-dev 2019-08-15 18:44:18 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f3a7f7abcd42b96eb6ffeccdf180049f1e4e0a6f

commit f3a7f7abcd42b96eb6ffeccdf180049f1e4e0a6f
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2019-08-15 18:43:24 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2019-08-15 18:44:10 +0000

    net-ftp/proftpd: drop old
    
    Bug: https://bugs.gentoo.org/690528
    Package-Manager: Portage-2.3.71, Repoman-2.3.17
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 net-ftp/proftpd/proftpd-1.3.6-r3.ebuild | 272 -------------------------------
 net-ftp/proftpd/proftpd-1.3.6-r4.ebuild | 274 --------------------------------
 2 files changed, 546 deletions(-)
Comment 15 Thomas Deutschmann (RETIRED) gentoo-dev 2019-10-26 22:41:24 UTC 
Repository is clean, all done!