PT-2015-7946 · Proftpd · Proftpd

Published 2015-12-24 · Updated 2015-12-24

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions proftpd (affected versions not specified)

Description The issue arises from the mod sftp module in proftpd, which lacks bounds or length limitations when reading SFTP extension key/value data from the network. This allows a malicious attacker to potentially cause excessive resource usage or crash the FTP daemon by encoding large values. The problem is related to how SSH encodes strings for network transport, using a 32-bit length followed by the bytes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2015-0485

Affected Products

Proftpd

References · 7

• https://lists.fedoraproject.org/pipermail/package-announce/2015-December/173656.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0485 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0485.html · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2015-November/171090.html · Vendor Advisory
• http://bugs.proftpd.org/show_bug.cgi?id=4210 · Note
• https://bugs.mageia.org/show_bug.cgi?id=17336 · Note
• http://bugs.proftpd.org/show_bug.cgi?id=4206 · Note