PT-2017-13958 · Psftpd · Psftpd

Published 2017-11-15 · Updated 2018-10-09 · CVE-2017-15271

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PSFTPd version 10.0.4 Build 729

Description A use-after-free issue can be triggered remotely in the SFTP component. This issue can be triggered prior to authentication, allowing for a denial-of-service (DoS) attack against the service. By sending a crafted SSH identification/version string to the server, a NULL pointer dereference can be caused due to a race condition in the window message handling. This is a result of incorrect cleanup code for invalid connections, leading to a use-after-free.

Recommendations For PSFTPd version 10.0.4 Build 729, consider disabling the SFTP component until a patch is available to prevent exploitation. Restrict access to the SSH service to minimize the risk of a DoS attack. Avoid using crafted SSH identification/version strings in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2017-15271

Affected Products

Psftpd

References · 6

• 🔥 https://exploit-db.com/exploits/43144 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15271 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15271 · Vendor Advisory
• http://securityfocus.com/archive/1/541518/100/0/threaded · Note
• https://x41-dsec.de/lab/advisories/x41-2017-006-psftpd · Note
• http://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html · Note