Re: [cobalt-security] ProFTPD Bug - may lead to a security issue

["Jonathan Michaelson" <michaelsonjd@xxxxxxxxxxx>]

> > There's no exploit  - yet.
> >
> > ProFTPD have release a bug fix version, but I haven't tried applying it
to
> > the RaQs yet. I'm hoping Cobalt will be QUICK with this one and get a
> > package out ASAP.
>
> How can Cobalt be quick if there's no exploit yet?

Eh? You want to wait until people can hack into your server before you fix
it? That doesn't make sense.

The point is to plug the hole before the dam breaks. ProFTPD have an RC1
available that fixes the problem and it's sensible security practice to
implement before any exploit is developed - not that there necessarily will
be an exploit, but there could. Ever heard the concpet: prevention is better
than cure?

Regards,
Jonathan Michaelson