The ProFTPD Project: Home

ProFTPD Highly configurable GPL-licensed FTP server software Current Versions Stable: 1.3.0 [ RELEASE_NOTES [/docs/RELEASE_NOTES-1.3.0] ] [ NEWS ] [ gz ] [ bz2 ] Candidate: None Mirrors and Downloads Download servers Web site mirrors PGP public keys MD5 & PGP signatures CVS Repository How to become a mirror Newsroom News Flashes Contrib module news Information What is ProFTPD? Features & Platforms Bug reporting system Bug reporting and security guidelines Sites powered by ProFTPD Forums Documentation Docs index RFCs FAQ Userguide Example configurations Mailing Lists Available Lists Announce Archive Users Archive Development Archive Copyright © 1999, 2000-5, The ProFTPD Project. 1.3.0 released [ 16/Apr/2006 ] The ProFTPD Project team is delighted to release 1.3.0 to the community. Please read RELEASE_NOTES and NEWS files for the full details. 1.3.0rc5 released [ 18/Mar/2006 ] The ProFTPD Project team is pleased to make the 1.3.0rc5 release available to the community. Highlights include fixed timestamps for chrooted processes where glibc-2.3 is in use, and fixed hanging of daemon processes on Mac OS X when shutting down. Please read RELEASE_NOTES and NEWS files for the full details. 1.3.0rc4 released [ 1/Mar/2006 ] The ProFTPD Project team is pleased to make the 1.3.0rc4 release available to the community. Highlights include logging improvements, Mac OSX 10.4 portability, and fixed run-time detection of Unix domain sockets. Please read the RELEASE_NOTES and NEWS files for the full details. 1.3.0rc3 released [ 31/Oct/2005 ] The ProFTPD Project team is pleased to make the 1.3.0rc3 release available to the community. Highlights include mod_facl improvements and better handling of SSL session shutdowns. Please read the RELEASE_NOTES and NEWS files for the full details. 1.3.0rc2 released [ 24/Jul/2005 ] The ProFTPD Project team is pleased to make the 1.3.0rc2 release available to the community. Highlights include mod_delay improvements, format string vulnerability fixes, and better support for legacy MySQL passwords. Please read the RELEASE_NOTES and NEWS files for the full details. 1.3.0rc1 released [ 10/Apr/2005 ] The ProFTPD Project team is pleased to make the 1.3.0rc1 release to the community. Highlights include DSO support, enhanced mod_sql and mod_tls modules, and POSIX ACL support. Please read the RELEASE_NOTES and NEWS files for the full details. "Timing attack" protection module [ 10/Nov/2004 ] The ProFTPD Project team has developed a mod_delay module to help mitigate the timing leak described by Leon Juranic. This module will be included in the next release of ProFTPD. Details on the module can be found here . ProFTPD "timing attack" [ 17/Oct/2004 ] Leon Juranic of the LSS Security team announced that he discovered a " security issue " in ProFTPD. As a matter of fact the issue he has found is not restricted to ProFTPD alone but can be discovered in any given software product which uses authentication mechanisms. The fix he proposes in his security advisory is a band-aid patch at best and won't be included in ProFTPD in its current form, since it's still prone to statistical analysis and only obfuscates the problem. Moreover different speeds of servers and authentication backends make fixing this problem by a random delay, with a fixed upper limit, impossible. Quoting from a writeup about a related OpenSSH/PAM timing attack : "There is currently no complete fix to this. Moreover, there are many smaller timing leaks which too are easy to use to obtain the same information. These are primarily in OpenSSH and in the system libraries (getpwnam(3), NSS modules, and so on). Solving this kind of timing leaks requires a re-design of the authentication code paths [..]". This is true for ProFTPD, too. The ProFTPD team is currently investigating methods that address this issue sufficiently. 1.2.10 released [ 04/Sep/2004 ] The ProFTPD Project team is pleased to release 1.2.10 to the community. Please read the NEWS , RELEASE_NOTES, and ChangeLog files for the full details.