PT-2015-3383 · Proftpd+2 · Proftpd+2

Stephan Zeisberg · Published 2015-05-18 · Updated 2024-10-14 · CVE-2019-18217

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.6b ProFTPD version 1.3.7rc before 1.3.7rc2

Description The issue is related to the incorrect handling of overly long commands in the main.c component of the ProFTPD FTP server. This can lead to a remote unauthenticated denial-of-service, causing the server to enter an infinite loop. The vulnerability allows a remote attacker to exploit this weakness, resulting in a denial-of-service.

Recommendations For ProFTPD versions prior to 1.3.6b, update to version 1.3.6b or later. For ProFTPD version 1.3.7rc before 1.3.7rc2, update to version 1.3.7rc2 or later.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2020-2973

ALT-PU-2020-2992

ALT-PU-2021-2692

ALT-PU-2023-5874

ALT-PU-2024-13729

BDU:2019-04710

CVE-2019-18217

DLA-1974-1

DSA-4559-1

OPENSUSE-SU-2020:0031-1

OPENSUSE-SU-2020_0031-1

OPENSUSE-SU-2024:11196-1

Affected Products

Alt Linux

Proftpd

Suse

References · 47

• 🔥 https://github.com/proftpd/proftpd/issues/846 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18217 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18217 · Security Note
• https://bdu.fstec.ru/vul/2019-04710 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18217 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RB2FPAWDWXT5ALAFIC5Y3RSEMXSFL6H2 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4559-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18217 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YLRPYEEMQJVAXO2SXRGOQ4HBFEEPCNXG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJDQRVZTILBX4BUCTIRKP2WBHDHDCJR5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18217 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RB2FPAWDWXT5ALAFIC5Y3RSEMXSFL6H2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-18217 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NJDQRVZTILBX4BUCTIRKP2WBHDHDCJR5 · Vendor Advisory