The ProFTPD Project: Home

ProFTPD Highly configurable GPL-licensed FTP server software Current Versions Stable: 1.2.10 [ NEWS [/docs/NEWS-1.2.10] ] [ gz ] [ bz2 ] Candidate: 1.3.0rc3 [ RELEASE_NOTES ] [ NEWS ] [ gz ] [ bz2 ] Mirrors and Downloads Download servers Web site mirrors PGP public keys MD5 & PGP signatures CVS Repository How to become a mirror Newsroom News Flashes Contrib module news Information What is ProFTPD? Features & Platforms Bug reporting system Bug reporting and security guidelines Sites powered by ProFTPD Forums Documentation Docs index RFCs FAQ Userguide Example configurations Mailing Lists Available Lists Announce Archive Users Archive Development Archive Copyright © 1999, 2000-5, The ProFTPD Project. 1.3.0rc3 released [ 31/Oct/2005 ] The ProFTPD Project team is pleased to make the 1.3.0rc3 release available to the community. Highlights include mod_facl improvements and better handling of SSL session shutdowns. Please read the RELEASE_NOTES and NEWS files for the full details. 1.3.0rc2 released [ 24/Jul/2005 ] The ProFTPD Project team is pleased to make the 1.3.0rc2 release available to the community. Highlights include mod_delay improvements, format string vulnerability fixes, and better support for legacy MySQL passwords. Please read the RELEASE_NOTES and NEWS files for the full details. 1.3.0rc1 released [ 10/Apr/2005 ] The ProFTPD Project team is pleased to make the 1.3.0rc1 release to the community. Highlights include DSO support, enhanced mod_sql and mod_tls modules, and POSIX ACL support. Please read the RELEASE_NOTES and NEWS files for the full details. "Timing attack" protection module [ 10/Nov/2004 ] The ProFTPD Project team has developed a mod_delay module to help mitigate the timing leak described by Leon Juranic. This module will be included in the next release of ProFTPD. Details on the module can be found here . ProFTPD "timing attack" [ 17/Oct/2004 ] Leon Juranic of the LSS Security team announced that he discovered a " security issue " in ProFTPD. As a matter of fact the issue he has found is not restricted to ProFTPD alone but can be discovered in any given software product which uses authentication mechanisms. The fix he proposes in his security advisory is a band-aid patch at best and won't be included in ProFTPD in its current form, since it's still prone to statistical analysis and only obfuscates the problem. Moreover different speeds of servers and authentication backends make fixing this problem by a random delay, with a fixed upper limit, impossible. Quoting from a writeup about a related OpenSSH/PAM timing attack : "There is currently no complete fix to this. Moreover, there are many smaller timing leaks which too are easy to use to obtain the same information. These are primarily in OpenSSH and in the system libraries (getpwnam(3), NSS modules, and so on). Solving this kind of timing leaks requires a re-design of the authentication code paths [..]". This is true for ProFTPD, too. The ProFTPD team is currently investigating methods that address this issue sufficiently. 1.2.10 released [ 04/Sep/2004 ] The ProFTPD Project team is pleased to release 1.2.10 to the community. Please read the NEWS , RELEASE_NOTES, and ChangeLog files for the full details.