CVE-2016-3125

HIGH

ProFTPD < 1.3.5b and 1.3.6 < 1.3.6rc2 - Weak Diffie-Hellman Key via TLSDHParamFile Directive

Title source: llm

Description

The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.

References (10)

Core 10

Core References

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-06/msg00045.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179905.html

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/03/11/14

Release Notes x_refsource_confirm

http://proftpd.org/docs/NEWS-1.3.6rc2

Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179109.html

Release Notes x_refsource_confirm

http://proftpd.org/docs/NEWS-1.3.5b

Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179143.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-05/msg00080.html

Issue Tracking x_refsource_confirm

http://bugs.proftpd.org/show_bug.cgi?id=4230

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/03/11/3

Scores

CVSS v3 7.5

EPSS 0.0137

EPSS Percentile 80.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-254 CWE-310

Status published

Products (5)

fedoraproject/fedora 22

fedoraproject/fedora 23

opensuse/opensuse 13.1

proftpd/proftpd 1.3.6 rc1

proftpd/proftpd < 1.3.5

Published Apr 05, 2016

Tracked Since Feb 18, 2026