Proftpd Project
Monthly
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-protected directories by prefixing paths with /proc/self/root in the RNFR (rename-from) command. Because the CVSS 4.0 vector specifies PR:L, exploitation requires a valid low-privilege FTP account, after which an attacker can rename and then retrieve files that configured Directory ACLs were meant to protect. There is no public exploit identified at time of analysis and no KEV listing, but the VulnCheck-assessed CVSS of 8.6 reflects the strong confidentiality and integrity impact on file-access controls.
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-protected directories by prefixing paths with /proc/self/root in the RNFR (rename-from) command. Because the CVSS 4.0 vector specifies PR:L, exploitation requires a valid low-privilege FTP account, after which an attacker can rename and then retrieve files that configured Directory ACLs were meant to protect. There is no public exploit identified at time of analysis and no KEV listing, but the VulnCheck-assessed CVSS of 8.6 reflects the strong confidentiality and integrity impact on file-access controls.