PT-2020-5165 · Proftpd+3 · Proftpd+3

Antonio Morales · Published 2018-01-02 · Updated 2025-10-22 · CVE-2020-9273

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ProFTPD version 1.3.7

Description The issue is related to a use-after-free vulnerability in the alloc pool function of the ProFTPD FTP server. This vulnerability can be triggered by interrupting the data transfer channel, which can lead to memory corruption and possible remote code execution. The vulnerability is associated with the use of memory after it has been freed.

Recommendations For ProFTPD version 1.3.7, consider updating to a newer version that contains a fix for this issue, as no specific workaround or patch is mentioned in the provided information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2018-1000

ALT-PU-2020-2973

ALT-PU-2020-2975

ALT-PU-2020-2992

ALT-PU-2021-2692

ALT-PU-2023-5707

ALT-PU-2023-5874

ALT-PU-2024-13729

BDU:2020-05776

CVE-2020-9273

DLA-2115-1

DLA-2115-2

DSA-4635-1

MGASA-2020-0120

OPENSUSE-SU-2020:0273-1

OPENSUSE-SU-2020_0273-1

OPENSUSE-SU-2024:11196-1

Affected Products

Alt Linux

Proftpd

Red Os

Suse

References · 55

• 🔥 https://github.com/ptef/CVE-2020-9273 · Exploit
• https://osv.dev/vulnerability/DLA-2115-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9273 · Security Note
• https://osv.dev/vulnerability/MGASA-2020-0120 · Vendor Advisory
• https://debian.org/security/2020/dsa-4635 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-9273 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHO3S5WPRRP7VGKIAHLYQVEYW5HRYIJN · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05776 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-9273 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-9273 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4635-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VCUPRYSJR7XOM3HQ6H5M4OGDU7OHCHBF · Vendor Advisory
• https://security.gentoo.org/glsa/202003-35 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0120.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XHO3S5WPRRP7VGKIAHLYQVEYW5HRYIJN · Vendor Advisory