Secunia

A security issue has been reported in ProFTPD, which can be exploited by malicious people to conduct spoofing attacks.

The security issues is caused due to an error in the "mod_tls" module when processing client SSL certificates. This can be exploited to trick a server into accepting a potentially malicious SSL certificate by including a NULL character in the "subjectAltName" certificate field.

This is related to vulnerability #2 in:
SA36093

NOTE: The security issue only affects systems having "UseReverseDNS" and "TLSVerifyClient" enabled, and "dNSNameRequired" set in "TLSOptions".

Solution
Update to version 1.3.2b.

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://bugs.proftpd.org/show_bug.cgi?id=3275

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area