Bugzilla – Bug 970890
VUL-0: CVE-2016-3125: proftpd: [TLSDHParamFile directive ignored]
Last modified: 2016-06-28 16:26:43 UTC
CVE-2016-3125 The ProFTPD daemon supports TLS encrypted connections via the mod_tls module. This module has a configuration option TLSDHParamFile to specify user-defined Diffie Hellman parameters. Versions older than 1.3.5b / 1.3.6rc2 had a bug that would cause the software to ignore the parameters and use Diffie Hellman key exchanges with 1024 bit: http://bugs.proftpd.org/show_bug.cgi?id=4230 The release notes[1] are confusing, as they mention only problems with keys smaller than 2048 bit, but I was also able to reproduce this issue with 4096 bit keys. But anyway, it is fixed in the latest versions for all key sizes I have tested. As 1024 bit DH is considered dangerously small these days and breakable by a powerful attacker I think this should be considered a security vulnerability. [1] http://proftpd.org/docs/RELEASE_NOTES-1.3.5b References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3125 http://seclists.org/oss-sec/2016/q1/612 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-3125.html http://bugs.proftpd.org/show_bug.cgi?id=4097
bugbot adjusting priority
ongoing work
This is an autogenerated message for OBS integration: This bug (970890) was mentioned in https://build.opensuse.org/request/show/394270 Factory / proftpd https://build.opensuse.org/request/show/394274 13.2+42.1 / proftpd
For Factory: https://build.opensuse.org/request/show/394270 Maintenance for Leap and 13.2: https://build.opensuse.org/request/show/394274 Maintenance for Evergreen 13.1: https://build.opensuse.org/request/show/394276
openSUSE-SU-2016:1334-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 970890 CVE References: CVE-2016-3125 Sources used: openSUSE Leap 42.1 (src): proftpd-1.3.5b-4.1 openSUSE 13.2 (src): proftpd-1.3.5b-6.1
This is an autogenerated message for OBS integration: This bug (970890) was mentioned in https://build.opensuse.org/request/show/399274 13.1 / proftpd
openSUSE-SU-2016:1558-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 970890 CVE References: CVE-2016-3125 Sources used: openSUSE 13.1 (src): proftpd-1.3.5b-10.1
This is an autogenerated message for OBS integration: This bug (970890) was mentioned in https://build.opensuse.org/request/show/404332 42.2 / proftpd
can we close this ?