PT-2005-1541 · Proftpd · Proftpd

Tavis Ormandy · Published 2005-02-19 · Updated 2008-09-05 · CVE-2005-0484

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 8.1.9

Description A format string issue in gprostats for ProFTPD may allow remote attackers to execute arbitrary code via an FTP transfer with a crafted filename, causing format string specifiers to be inserted into the ProFTPD transfer log.

Recommendations For versions prior to 8.1.9, update to version 8.1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the FTP service until the update is applied.

Exploit

Fix

Related Identifiers

CVE-2005-0484

Affected Products

Proftpd

References · 3

• 🔥 http://bugs.gentoo.org/show_bug.cgi?id=81894 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-0484 · Security Note
• http://security.gentoo.org/glsa/glsa-200502-26.xml · Vendor Advisory