CVE-2009-0543

Name	CVE-2009-0543
Description	ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1727-1, DSA-1730-1
Debian Bugs	516388

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
proftpd-dfsg (PTS)	bullseye	1.3.7a+dfsg-12+deb11u2	fixed
	bullseye (security)	1.3.7a+dfsg-12+deb11u5	fixed
	bookworm, bookworm (security)	1.3.8+dfsg-4+deb12u4	fixed
	trixie	1.3.8.c+dfsg-4	fixed
	forky, sid	1.3.9~dfsg-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
proftpd-dfsg	source	etch	(not affected)
proftpd-dfsg	source	lenny	1.3.1-17lenny2
proftpd-dfsg	source	(unstable)	1.3.2-1	medium	516388

[etch] - proftpd-dfsg <not-affected> (etch version not affected)