Vulnerability in ProFTPD Project ProFTPD

[ Description ]Official description

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• abraxaslabs.tech/research/proftpd-rewrite-utf8trans
• github.com/proftpd/proftpd
• github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_rewrite.c
• github.com/proftpd/proftpd/commit/502d280b8d0ef72e44c6dd0a35a9405af0a1e301
• github.com/proftpd/proftpd/releases/tag/v1.3.10rc5
• github.com/proftpd/proftpd/releases/tag/v1.3.9e
• www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-buffer-overflow-via-mo…