{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "ProFTPD 1.2.9rc1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ProFTPD 1.2.9rc2.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ProFTPD 1.2.8rc2 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ProFTPD versions 1.2.7 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ProFTPD 1.2.8 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "ProFTPD 1.2.8rc1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nProFTPD est un serveur FTP (File Transfer Protocol). Un d\u00e9bordement de\nm\u00e9moire est d\u00e9clench\u00e9 lors du t\u00e9l\u00e9chargement en mode ASCII d\u0027un fichier\nhabilement constitu\u00e9 et pr\u00e9alablement d\u00e9pos\u00e9 sur le serveur ProFTPD. Il\nest alors possible pour un utilisateur mal intentionn\u00e9 d\u0027ex\u00e9cuter du\ncode arbitraire \u00e0 distance.\n\n## Contournement provisoire\n\nInterdire le d\u00e9p\u00f4t de fichiers sur le serveur ProFTPD. Editer le fichier\nde configuration de ProFTPD comme suit :\n\n                    \u003cLimit WRITE\u003e\n                          DenyAll\n                    \u003c/Limit\u003e\n\n## Solution\n\nLes versions disponibles sur le site de ProFTPD corrigent cette\nvuln\u00e9rabilit\u00e9 :\n\n    ftp://ftp.proftpd.org\n",
  "cves": [],
  "links": [
    {
      "title": "Mise \u00e0 jour de s\u00e9curit\u00e9 du paquetage NetBSD proftpd :",
      "url": "ftp://ftp.netbsd.org/pub/NetBSD/packages/distfiles/vulnerabilities"
    },
    {
      "title": "Site Internet de ProFTPD :",
      "url": "http://www.proftpd.org"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 de ISS X-Force du 23 septembre 2003 :",
      "url": "http://xforce.iss.net/xforce/alerts/id/154"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 Mandrake MDKSA-2003:095 :",
      "url": "http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:095"
    },
    {
      "title": "Avis de s\u00e9curit\u00e9 FreeBSD du 05 janvier 2004 :",
      "url": "http://www.vuxml.org/freebsd/"
    }
  ],
  "reference": "CERTA-2003-AVI-155",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2003-09-26T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence CVE et du bulletin de s\u00e9curit\u00e9 Mandrake.",
      "revision_date": "2003-09-30T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux bulletins de s\u00e9curit\u00e9 FreeBSD et NetBSD.",
      "revision_date": "2004-05-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans ProFTPD permet \u00e0 un utilisateur mal intentionn\u00e9\nd\u0027ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de ProFTPD",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 ISS X-Force du 23/09/2003",
      "url": null
    }
  ]
}