Security Advisory: ProFTPD

[MattDees]

Due to a vulnerability in ProFTPD we are advising that everyone use PureFTPd untill we roll out a patch. The patch will be rolled out as soon as we possible can (I will post in this thread when we do so)

 

[eth00]

Thanks for the info, just talked with Billy and he confirmed this is an issue.

*edit* now matt is atleast on the staff group so looks legit.

 

[jamesbond]

http://updates.cpanel.net/ftpinstall/version

When can we expect 1.3.0rc1tls for current/release?

 

[qwerty]

http://updates.cpanel.net/ftpinstall/version

When can we expect 1.3.0rc1tls for current/release?

I'd like to know this as well?

 

[cPanelBilly]

We are still waiting on the full testing to be done as soon as it is it will be rolled out to the rest as soon as testing is done.

 

[KatieBuller]

Can I have an update on the testing, please.

 

[cPanelBilly]

It is currently in:
BETA, EDGE, CURRENT

If all goes well it will be in RELEASE monday and then STABLE on wed.

 

[knipper]

Hey all...
I am currently running WHM 10.1.0 cPanel 10.2.0-R82 and when updates ran last night it completely broke proftd ( I hadn't seen this thread so no change was made)

Was proftpd disabled by cPanel, or was a patch implemented which caused problems for me?

I am going to change now to pure-ftpd and see if ftpd will run. Anyone else have issues today?

 

[knipper]

OK.... looks like I have a problem. I tried twice to switch from proftpd to pure-ftpd via the Tweak FTP menu within WHM. When I click to "switch to pure-ftpd" I get the normal page loading, etc. But it seems to just hang... first time I let it go about 10 mins.... tried to restart ftpd but didn't work.

Tried to use the switch button again.... this time waited 15-20mins to no avail.

What would the command be (for the script) to switch from within shell/root so I can see whats happening?

Thanks in advance.

 

[eth00]

/scripts/ftpup
will update the ftpd

 

[knipper]

Thanks eth00...

Looks like it didin't need to do it after all via root. When I logged in I first took a look at the logs, and saw one of my clients had logged in via pure-ftpd just minutes before and was successfull. I ran a couple FTP log-in tests and it seemed to be working.

I went back to WHM, to tweak FTP and it showed Pure-ftpd was now being used.

Just not sure why to took so long in WHM, and never did actually see any type of success message.

 

[DogTags]

Just checkin in to see if the stable patch has been rolled out

Thanks

 

[PbG]

Why isn't this NOTICE in WHM news?? Furthermore why can't we select whether we want news or icons to load by default?

 

[Aric1]

You should make your requests in bugzilla, so they have them on record.

The WHM news is almost never updated.

Aric

 

[PbG]

I did that too.

You should make your requests in bugzilla, so they have them on record.

The WHM news is almost never updated.

Aric