PT-2015-7946 · Proftpd · Proftpd

Publicado 2015-12-24 · Atualizado 2015-12-24

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions proftpd (affected versions not specified)

Description The issue arises from the mod sftp module in proftpd, which lacks bounds or length limitations when reading SFTP extension key/value data from the network. This allows a malicious attacker to potentially cause excessive resource usage or crash the FTP daemon by encoding large values. The problem is related to how SSH encodes strings for network transport, using a 32-bit length followed by the bytes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

MGASA-2015-0485

Produtos afetados

Proftpd

Referências · 7

• http://bugs.proftpd.org/show_bug.cgi?id=4210 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=17336 · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2015-December/173656.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0485 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2015-0485.html · Nota de Segurança
• http://bugs.proftpd.org/show_bug.cgi?id=4206 · Nota
• https://lists.fedoraproject.org/pipermail/package-announce/2015-November/171090.html · Aviso do Fabricante