Mitigation Instructions for CVE-2019-12815

SUBJECT: CVE-2019-12815 ProFTPD Use-After-Free Vulnerability

TECH STACK: ProFTPD versions 1.3.1 to 1.3.6

DATE(S) ISSUED: 06/19/2019

CRITICALITY: HIGH

OVERVIEW:

CVE-2019-12815 is a use-after-free vulnerability in ProFTPD, an FTP server software, that allows an attacker to execute arbitrary code on the affected system. The vulnerability exists due to improper handling of FTP commands, which can lead to memory corruption.

An attacker could exploit this vulnerability by sending specially crafted FTP commands to the server. This could allow the attacker to execute arbitrary code with the privileges of the ProFTPD process, potentially leading to a complete system compromise.

ProFTPD versions 1.3.1 to 1.3.6 are affected by this vulnerability.

NIST Description: In ProFTPD 1.3.1 to 1.3.6, a use-after-free vulnerability in the handling of FTP commands allows remote attackers to execute arbitrary code via a crafted sequence of FTP commands.

THREAT INTELLIGENCE:

There is evidence that threat actors have been actively exploiting CVE-2019-12815 in the wild. This vulnerability poses a significant risk as it allows attackers to gain unauthorized access to the affected system and potentially take control of it.

NIST: NVD

Base Score: 9.8 CRITICAL

Vector: CVSS:3.1/AV

/AC

/PR

/UI

/S

/C

/I

/A

SOLUTION:

To fix the CVE-2019-12815 vulnerability in ProFTPD, you should upgrade to a fixed version of the software. The specific version you should upgrade to will depend on which version of ProFTPD you are currently using.

The following versions of ProFTPD include a fix for the vulnerability:

• 1.3.6a and later

Steps to Mitigate:

1. Upgrade ProFTPD:

   • Download the latest version of ProFTPD from the ProFTPD download page.
   • Follow the installation guide to install the new version.

2. Disable mod_copy Module:

   • Until you can upgrade, disable the mod_copy module in your ProFTPD configuration file (proftpd.conf) as a workaround.
   • To disable mod_copy, add or uncomment the following line:
     php

      

     <IfModule mod_copy.c>
<Limit CPFR CPTO>
DenyAll
</Limit>
</IfModule>


3. Verify Fixes:

   • Ensure that any third-party modules or customizations are compatible with the new version.
   • Confirm that the fix has been applied correctly by checking for any error messages or unusual behavior after the upgrade.

4. Monitor Systems:

   • Regularly check for updates and patches for ProFTPD.
   • Use vulnerability scanners like Tenable to identify affected systems and ensure compliance.

REFERENCES:

• NIST NVD CVE-2019-12815
• Debian Security Advisory DSA-4491-1
• Gentoo Security Advisory GLSA-201908-16
• Tenable Blog on CVE-2019-12815