CVE-2016-3125 ProFTPD TLSDHParam File Weak Diffie-Hellman Exchange Vulnerability

ProFTPD is an open source FTP server compatible with Unix-like systems and Windows (via Cygwin). It is among one of the most popular FTP servers used today for Unix-like systems.

Diffie Hellman is an algorithm used to derive shared secrets between two parties. It is used symmetric cryptographic key exchanges for many algorithms such as AES etc.

ProFTPD versions prior to 1.3.5b and 1.3.6rc2 do not handle the TLSDHParamFile directive in the mod_tls module properly.

The improper handling of the TLSDHParamFile directive can lead to weaker Diffie-Hellman key exchanges than intended. This vulnerability can subsequently allow the attacker impact the service via unknown vectors.

ProFTPD should be updated to versions 1.3.5b and 1.3.6rc2 to mitigate this vulnerability.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

10/Mar/2016: ProFTPD

10/Mar/2016: ProFTPD