Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."

The remote host is using ProFTPD, a free FTP server for Unix and Linux.  The version of ProFTPD running on the remote host splits an overly long FTP command into a series of shorter ones and executes each in turn.  If an attacker can trick a ProFTPD administrator into accessing a specially-formatted HTML link, he may be able to cause arbitrary FTP commands to be executed in the context of the affected application with the administrator's privileges.

The remote host is using ProFTPD, a free FTP server for Unix and Linux.

According to its banner, the version of ProFTPD installed on the remote host is earlier than 1.3.0a. As such, it may be affected by one or more of the following vulnerabilities :

  - An off-by-one string manipulation flaw exists in the     'sreplace' function.  (CVE-2006-5815)

  - A buffer overflow exists in the 'tls_x509_name_oneline'     function of the mod_tls module involving the data     length argument. (CVE-2006-6170)

  - An off-by-two buffer overflow exists due to a failure     to properly set the buffer size limit when     'CommandBufferSize' is specified in the configuration     file, an issue which is disputed by the developers.
    (CVE-2006-6171)

An attacker may be able to leverage this issue to crash the affected service or execute arbitrary code remotely, subject to the privileges under which the application operates.

New proftpd packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security issues.

A stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier, allows remote attackers to cause a denial of service, as demonstrated by vd_proftpd.pm, a 'ProFTPD remote exploit.' (CVE-2006-5815)

Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815. (CVE-2006-6170)

ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from an initial vague disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability. (CVE-2006-6171)

Packages have been patched to correct these issues.

Update :

The previous update incorrectly linked the vd_proftd.pm issue with the CommandBufferSize issue. These are two distinct issues and the previous update only addressed CommandBufferSize (CVE-2006-6171), and the mod_tls issue (CVE-2006-6170).

The proftpd development team reports that several remote buffer overflows had been found in the proftpd server.

The remote host is affected by the vulnerability described in GLSA-200611-26 (ProFTPD: Remote execution of arbitrary code)

    Evgeny Legerov discovered a stack-based buffer overflow in the     s_replace() function in support.c, as well as a buffer overflow in in     the mod_tls module. Additionally, an off-by-two error related to the     CommandBufferSize configuration directive was reported.
  Impact :

    An authenticated attacker could exploit the s_replace() vulnerability     by uploading a crafted .message file or sending specially crafted     commands to the server, possibly resulting in the execution of     arbitrary code with the rights of the user running ProFTPD. An     unauthenticated attacker could send specially crafted data to the     server with mod_tls enabled which could result in the execution of     arbitrary code with the rights of the user running ProFTPD. Finally,     the off-by-two error related to the CommandBufferSize configuration     directive was fixed - exploitability of this error is disputed. Note     that the default configuration on Gentoo is to run ProFTPD as an     unprivileged user, and has mod_tls disabled.
  Workaround :

    There is no known workaround at this time.

Due to technical problems yesterday's proftpd update lacked a build for the amd64 architecture, which is now available. For reference please find below the original advisory text :

  Several remote vulnerabilities have been discovered in the proftpd   FTP daemon, which may lead to the execution of arbitrary code or   denial of service. The Common Vulnerabilities and Exposures project   identifies the following problems :

    - CVE-2006-5815       It was discovered that a buffer overflow in the       sreplace() function may lead to denial of service and       possibly the execution of arbitrary code.

    - CVE-2006-6170       It was discovered that a buffer overflow in the       mod_tls addon module may lead to the execution of       arbitrary code.

    - CVE-2006-6171       It was discovered that insufficient validation of FTP       command buffer size limits may lead to denial of       service. Due to unclear information this issue was       already fixed in DSA-1218 as CVE-2006-5815.

ID	Name	Product	Family	Severity
4687	ProFTPD Command Truncation Cross-Site Request Forgery	Nessus Network Monitor	FTP Servers	medium
27055	ProFTPD < 1.3.0a Multiple Vulnerabilities	Nessus	FTP	critical
24660	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 : proftpd (SSA:2006-335-02)	Nessus	Slackware Local Security Checks	critical
24602	Mandrake Linux Security Advisory : proftpd (MDKSA-2006:217-1)	Nessus	Mandriva Local Security Checks	critical
23952	FreeBSD : proftpd -- remote code execution vulnerabilities (3f851b22-89fb-11db-a937-003048116330)	Nessus	FreeBSD Local Security Checks	critical
23762	GLSA-200611-26 : ProFTPD: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
23757	Debian DSA-1222-2 : proftpd - several vulnerabilities	Nessus	Debian Local Security Checks	critical
801026	ProFTPD Command Truncation Cross-Site Request Forgery	Log Correlation Engine	FTP Servers	medium

Detections

Analytics

CVE-2006-5815

critical

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

medium