CVE-2009-0542

Name	CVE-2009-0542
Description	SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-1727-1, DSA-1730-1
Debian Bugs	516388

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
proftpd-dfsg (PTS)	buster	1.3.6-4+deb10u6	fixed
	buster (security)	1.3.6-4+deb10u4	fixed
	bullseye	1.3.7a+dfsg-12+deb11u2	fixed
	bookworm	1.3.8+dfsg-2	fixed
	sid	1.3.8+dfsg-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
proftpd-dfsg	source	etch	(not affected)
proftpd-dfsg	source	lenny	1.3.1-17lenny2
proftpd-dfsg	source	(unstable)	1.3.2-1	medium	516388

[etch] - proftpd-dfsg <not-affected> (etch version not affected)