CVE-2009-0543 - Vulnerability Details - OpenCVE

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Proftpd	Proftpd

Configuration 1 [-]

cpe:2.3:a:proftpd:proftpd:1.3.1:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://bugs.proftpd.org/show_bug.cgi?id=3173
http://secunia.com/advisories/34268
http://security.gentoo.org/glsa/glsa-200903-27.xml
http://www.debian.org/security/2009/dsa-1730
http://www.mandriva.com/security/advisories?name=MDVSA-2009:061
http://www.openwall.com/lists/oss-security/2009/02/11/4
http://www.openwall.com/lists/oss-security/2009/02/11/5

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-02-12T16:00:00

Updated: 2024-08-07T04:40:05.052Z

Reserved: 2009-02-12T00:00:00

Link: CVE-2009-0543

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-02-12T16:30:00.297

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-0543

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-02-11T00:00:00", "descriptions": [{"lang": "en", "value": "ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2009-03-06T10:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "DSA-1730", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2009/dsa-1730"}, {"name": "[oss-security] 20090211 Re: CVE request for proftpd", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/02/11/5"}, {"name": "34268", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/34268"}, {"name": "MDVSA-2009:061", "tags": ["vendor-advisory", "x_refsource_MANDRIVA"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:061"}, {"name": "GLSA-200903-27", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "http://security.gentoo.org/glsa/glsa-200903-27.xml"}, {"name": "[oss-security] 20090211 CVE request for proftpd", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/02/11/4"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.proftpd.org/show_bug.cgi?id=3173"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-0543", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-1730", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2009/dsa-1730"}, {"name": "[oss-security] 20090211 Re: CVE request for proftpd", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/02/11/5"}, {"name": "34268", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/34268"}, {"name": "MDVSA-2009:061", "refsource": "MANDRIVA", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:061"}, {"name": "GLSA-200903-27", "refsource": "GENTOO", "url": "http://security.gentoo.org/glsa/glsa-200903-27.xml"}, {"name": "[oss-security] 20090211 CVE request for proftpd", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/02/11/4"}, {"name": "http://bugs.proftpd.org/show_bug.cgi?id=3173", "refsource": "CONFIRM", "url": "http://bugs.proftpd.org/show_bug.cgi?id=3173"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T04:40:05.052Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-1730", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2009/dsa-1730"}, {"name": "[oss-security] 20090211 Re: CVE request for proftpd", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/02/11/5"}, {"name": "34268", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/34268"}, {"name": "MDVSA-2009:061", "tags": ["vendor-advisory", "x_refsource_MANDRIVA", "x_transferred"], "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:061"}, {"name": "GLSA-200903-27", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "http://security.gentoo.org/glsa/glsa-200903-27.xml"}, {"name": "[oss-security] 20090211 CVE request for proftpd", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/02/11/4"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.proftpd.org/show_bug.cgi?id=3173"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-0543", "datePublished": "2009-02-12T16:00:00", "dateReserved": "2009-02-12T00:00:00", "dateUpdated": "2024-08-07T04:40:05.052Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:proftpd:proftpd:1.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "0629F25F-B9C6-4FC7-B67E-E6B38E59E60B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres."}, {"lang": "es", "value": "ProFTPD Server v1.3.1, con soporte NLS habilitado, permite a atacantes remotos evitar los mecanismos de protecci\u00f3n de inyecci\u00f3n SQL a trav\u00e9s de caracteres multibyte inv\u00e1lidos y codificados, que no son correctamente manejados en (1) mod_sql_mysql y (2) mod_sql_postgres."}], "id": "CVE-2009-0543", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-02-12T16:30:00.297", "references": [{"source": "cve@mitre.org", "url": "http://bugs.proftpd.org/show_bug.cgi?id=3173"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/34268"}, {"source": "cve@mitre.org", "url": "http://security.gentoo.org/glsa/glsa-200903-27.xml"}, {"source": "cve@mitre.org", "url": "http://www.debian.org/security/2009/dsa-1730"}, {"source": "cve@mitre.org", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:061"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2009/02/11/4"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2009/02/11/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.proftpd.org/show_bug.cgi?id=3173"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/34268"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://security.gentoo.org/glsa/glsa-200903-27.xml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2009/dsa-1730"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:061"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/02/11/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/02/11/5"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}