PT-2006-1004 · Proftpd · Proftpd

Evgeny Legerov

·

Publicado

2006-11-08

·

Atualizado

2018-10-17

·

CVE-2006-6170

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: ProFTPD versions 1.3.0a and earlier
Description: The issue is related to a buffer overflow in the tls x509 name oneline function within the mod tls module. This allows remote attackers to execute arbitrary code by providing a large data length argument. The vulnerability can be exploited remotely and may lead to disruption of confidentiality, integrity, and availability of protected information.
Recommendations: For ProFTPD versions 1.3.0a and earlier, consider disabling the mod tls module as a temporary workaround until a patch is available. Restrict access to the tls x509 name oneline function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2015-02016
CVE-2006-6170
DSA-1222-1

Produtos afetados

Proftpd