PT-2004-1500 · Proftpd · Proftpd

Published 2004-03-18 · Updated 2024-02-02 · CVE-2004-0346

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ProFTPD versions 1.2.7 through 1.2.9rc2

Description The issue is caused by an off-by-one buffer overflow in the xlate ascii write() function. This can be exploited by a remote attacker who issues a specially crafted RETR command containing 1023 bytes or more that begins with a Line Feed (LF) character, allowing the attacker to overflow a buffer and execute arbitrary code on the system with the privileges of ProFTPD.

Recommendations For ProFTPD versions 1.2.7 through 1.2.9rc2, update to version 1.2.9rc3 or later to resolve the issue. As a temporary workaround, consider restricting access to the RETR command until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2004-0346

Affected Products

Proftpd

References · 7

• 🔥 http://securityfocus.com/bid/9782 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0346 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0346 · Security Note
• http://marc.info/?l=bugtraq&m=107824679817240&w=2 · Note
• http://securitylab.ru/43343.html · Note
• http://xforce.iss.net/xforce/xfdb/15387 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15387 · Note