Mitigation Instructions for Redis Server Unprotected by Password Authentication
Subject: Redis Server Unprotected by Password Authentication
1 min read
CyRisk Vulnerability Management Team
:
Jun 18, 2024 12:25:57 PM
SUBJECT: CVE-2019-12815 ProFTPD Use-After-Free Vulnerability
TECH STACK: ProFTPD versions 1.3.1 to 1.3.6
DATE(S) ISSUED: 06/19/2019
CRITICALITY: HIGH
OVERVIEW:
CVE-2019-12815 is a use-after-free vulnerability in ProFTPD, an FTP server software, that allows an attacker to execute arbitrary code on the affected system. The vulnerability exists due to improper handling of FTP commands, which can lead to memory corruption.
An attacker could exploit this vulnerability by sending specially crafted FTP commands to the server. This could allow the attacker to execute arbitrary code with the privileges of the ProFTPD process, potentially leading to a complete system compromise.
ProFTPD versions 1.3.1 to 1.3.6 are affected by this vulnerability.
NIST Description: In ProFTPD 1.3.1 to 1.3.6, a use-after-free vulnerability in the handling of FTP commands allows remote attackers to execute arbitrary code via a crafted sequence of FTP commands.
THREAT INTELLIGENCE:
There is evidence that threat actors have been actively exploiting CVE-2019-12815 in the wild. This vulnerability poses a significant risk as it allows attackers to gain unauthorized access to the affected system and potentially take control of it.
NIST: NVD
Base Score: 9.8 CRITICAL
Vector: CVSS:3.1/AV
/AC
/PR
/UI
/S
/C
/I
/A
SOLUTION:
To fix the CVE-2019-12815 vulnerability in ProFTPD, you should upgrade to a fixed version of the software. The specific version you should upgrade to will depend on which version of ProFTPD you are currently using.
The following versions of ProFTPD include a fix for the vulnerability:
Steps to Mitigate:
Upgrade ProFTPD:
Disable mod_copy Module:
proftpd.conf
) as a workaround.<IfModule mod_copy.c>
<Limit CPFR CPTO>
DenyAll
</Limit>
</IfModule>
Verify Fixes:
Monitor Systems:
REFERENCES:
Subject: Redis Server Unprotected by Password Authentication
Subject: Drupal Unsupported Version Detection (6.x)
Subject: Microsoft SQL Server Unsupported Version Detection