CVE-2009-0543

Name	CVE-2009-0543
Description	ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-1727-1, DSA-1730-1
Debian Bugs	516388

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
proftpd-dfsg (PTS)	buster	1.3.6-4+deb10u6	fixed
	buster (security)	1.3.6-4+deb10u4	fixed
	bullseye	1.3.7a+dfsg-12+deb11u2	fixed
	bookworm	1.3.8+dfsg-2	fixed
	sid	1.3.8+dfsg-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
proftpd-dfsg	source	etch	(not affected)
proftpd-dfsg	source	lenny	1.3.1-17lenny2
proftpd-dfsg	source	(unstable)	1.3.2-1	medium	516388

[etch] - proftpd-dfsg <not-affected> (etch version not affected)