Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 690528 (CVE-2019-12815)

Summary: <net-ftp/proftpd-1.3.6-r5: file copy vulnerability in mod_copy allows for remote code execution (CVE-2019-12815)
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: slyfox
Priority: Normal Flags: stable-bot: sanity-check+
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B2 [glsa+ cve]
Package list:
net-ftp/proftpd-1.3.6-r5
Runtime testing required: No

Description GLSAMaker/CVETool Bot gentoo-dev 2019-07-23 20:25:36 UTC
CVE-2019-12815 (https://nvd.nist.gov/vuln/detail/CVE-2019-12815):
  An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b
  allows for remote code execution and information disclosure without
  authentication, a related issue to CVE-2015-3306.
Comment 1 Larry the Git Cow gentoo-dev 2019-07-24 06:40:52 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7a15285681e428f4d4800705b1561db599c3cf79

commit 7a15285681e428f4d4800705b1561db599c3cf79
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2019-07-24 06:40:13 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2019-07-24 06:40:45 +0000

    net-ftp/proftpd: fix mod_copy RCE, bug #690528
    
    Also known as CVE-2019-12815.
    
    Bug: https://bugs.gentoo.org/690528
    Package-Manager: Portage-2.3.69, Repoman-2.3.16
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 net-ftp/proftpd/files/proftpd-1.3.6-mod_copy.patch |  96 +++++++
 net-ftp/proftpd/proftpd-1.3.6-r5.ebuild            | 275 +++++++++++++++++++++
 2 files changed, 371 insertions(+)
Comment 2 Sergei Trofimovich (RETIRED) gentoo-dev 2019-07-24 06:48:14 UTC
Arches, please stabilize
    =net-ftp/proftpd-1.3.6-r5
for the following target keywords:
    KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 sparc x86"

Thanks!
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2019-07-24 20:51:12 UTC
x86 stable
Comment 4 Agostino Sarubbo gentoo-dev 2019-07-25 13:06:51 UTC
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2019-07-26 09:17:13 UTC
ppc64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-07-26 09:52:44 UTC
ppc stable
Comment 7 Rolf Eike Beer archtester 2019-07-26 18:41:45 UTC
hppa/sparc stable
Comment 8 Sergei Trofimovich (RETIRED) gentoo-dev 2019-07-27 07:10:03 UTC
ia64 stable
Comment 9 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2019-07-28 20:21:17 UTC
arm stable
Comment 10 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2019-07-28 20:21:37 UTC
alpha stable
Comment 11 Aaron Bauman (RETIRED) gentoo-dev 2019-08-11 22:55:55 UTC
@maintainer, please drop vulnerable.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2019-08-15 15:58:11 UTC
This issue was resolved and addressed in
 GLSA 201908-16 at https://security.gentoo.org/glsa/201908-16
by GLSA coordinator Aaron Bauman (b-man).
Comment 13 Aaron Bauman (RETIRED) gentoo-dev 2019-08-15 15:58:36 UTC
re-opened for cleanup
Comment 14 Larry the Git Cow gentoo-dev 2019-08-15 18:44:18 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f3a7f7abcd42b96eb6ffeccdf180049f1e4e0a6f

commit f3a7f7abcd42b96eb6ffeccdf180049f1e4e0a6f
Author:     Sergei Trofimovich <slyfox@gentoo.org>
AuthorDate: 2019-08-15 18:43:24 +0000
Commit:     Sergei Trofimovich <slyfox@gentoo.org>
CommitDate: 2019-08-15 18:44:10 +0000

    net-ftp/proftpd: drop old
    
    Bug: https://bugs.gentoo.org/690528
    Package-Manager: Portage-2.3.71, Repoman-2.3.17
    Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>

 net-ftp/proftpd/proftpd-1.3.6-r3.ebuild | 272 -------------------------------
 net-ftp/proftpd/proftpd-1.3.6-r4.ebuild | 274 --------------------------------
 2 files changed, 546 deletions(-)
Comment 15 Thomas Deutschmann (RETIRED) gentoo-dev 2019-10-26 22:41:24 UTC
Repository is clean, all done!