PT-2026-60983 · Proftpd · Proftpd Mod Sftp
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ProFTPD mod sftp (affected versions not specified)
Description
An authenticated SFTP user can trigger a heap-based buffer overflow. The
fxp packet read() function fails to perform a minimum sanity check on the attacker-supplied 32-bit big-endian SFTP packet length. Providing a value of 0 causes an unsigned subtraction to underflow, resulting in an oversized memory request of approximately 4 GB. Due to a type mismatch where the size is passed to new block() as a 32-bit integer, a small block of approximately 512 bytes is allocated instead of the requested size. This allows an attacker to stream controlled bytes past the end of the allocation, leading to a heap buffer overflow. This can be used to crash the per-connection session child, resulting in a remote denial of service. Depending on the heap layout, heap metadata corruption may also be possible.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Proftpd Mod Sftp