ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files.

A buffer overflow exists in the ProFTPD code that handles translation of newline characters during ASCII-mode file uploads. An attacker may exploit this buffer overflow by uploading a specially crafted file, resulting in code execution and ultimately a remote root compromise.

The remote host is running a version of ProFTPd which seems to be vulnerable to a buffer overflow when a user downloads a malformed ASCII file.
An attacker with upload privileges on this host may abuse this flaw to gain a root shell on this host.

A vulnerability was discovered by X-Force Research at ISS in ProFTPD's handling of ASCII translation. An attacker, by downloading a carefully crafted file, can remotely exploit this bug to create a root shell.

The ProFTPD team encourages all users to upgrade to version 1.2.7 or higher. The problematic code first appeared in ProFTPD 1.2.7rc1, and the provided packages are all patched by the ProFTPD team to protect against this vulnerability.

Update :

The previous update had a bug where the new packages would terminate with a SIGNAL 11 when the command 'NLST -alL' was performed in certain cases, such as if the size of the output of the command was greater than 1024 bytes.

These updated packages have a fix applied to prevent this crash.

The remote host is running a version of ProFTPD which seems to be vulnerable to a buffer overflow when a user downloads a malformed ASCII file.

An attacker with upload privileges on this host may abuse this flaw to gain a root shell on this host.

*** The author of ProFTPD did not increase the version number
*** of his product when fixing this issue, so it might be false
*** positive.

ID	Name	Product	Family	Severity
37015	FreeBSD : ProFTPD ASCII translation bug resulting in remote root compromise (cf0fb426-3f96-11d8-b096-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	high
1844	ProFTPd ASCII Newline Character Overflow	Nessus Network Monitor	FTP Servers	high
14077	Mandrake Linux Security Advisory : proftpd (MDKSA-2003:095-1)	Nessus	Mandriva Local Security Checks	high
11849	ProFTPD File Transfer Newline Character Overflow	Nessus	FTP	high
801023	ProFTPd ASCII Newline Character Overflow	Log Correlation Engine	FTP Servers	high

Detections

Analytics

CVE-2003-0831

critical

Tenable Plugins

high

high

high

high

high