Description
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ProFTPD Project ProFTPD
Default version status: unaffected
0 to < 1.3.9eaffected1.3.10rc1 to < 1.3.10rc5affected
pkg:github/proftpd/proftpdReferences
- https://github.com/proftpd/proftpd/commit/502d280b8d0ef72e44c6dd0a35a9405af0a1e301 ↗
- https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_rewrite.c#L2052 ↗
- https://github.com/proftpd/proftpd/releases/tag/v1.3.9e ↗
- https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5 ↗
- https://abraxaslabs.tech/research/proftpd-rewrite-utf8trans ↗
- https://github.com/proftpd/proftpd ↗
- https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-buffer-overflow-via-mod-rewrite-utf8trans-rewritemap ↗