Devnull445

**Name of the Vulnerable Software and Affected Versions** ProFTPD mod sftp (affected versions not specified) **Description** An authenticated SFTP user can trigger a heap-based buffer overflow. The `fxp packet read()` function fails to perform a minimum sanity check on the attacker-supplied 32-bit big-endian SFTP packet length. Providing a value of 0 causes an unsigned subtraction to underflow, resulting in an oversized memory request of approximately 4 GB. Due to a type mismatch where the size is passed to `new block()` as a 32-bit integer, a small block of approximately 512 bytes is allocated instead of the requested size. This allows an attacker to stream controlled bytes past the end of the allocation, leading to a heap buffer overflow. This can be used to crash the per-connection session child, resulting in a remote denial of service. Depending on the heap layout, heap metadata corruption may also be possible. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.