Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.

The remote host is using ProFTPD, a free FTP server for Unix and Linux.
According to its banner, the version of ProFTPD installed on the remote host is earlier than 1.3.5rc4 and is affected by a Denial of Service vulnerability in the mod_sftp_pam module.

The ftp server ProFTPD was updated to 1.3.5a to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-3306: Unauthenticated copying of files via SITE     CPFR/CPTO allowed by mod_copy (boo#927290)

In addition, proftpd was updated to 1.3.5a to fix a number of upstream bugs and improve functionality.

proftpd was updated to 1.3.4d.

  - Fixed broken build when using --disable-ipv6 configure     option

  - Fixed mod_sql 'SQLAuthType Backend' MySQL issues

  - fix for bnc#843444 (CVE-2013-4359)

  - http://bugs.proftpd.org/show_bug.cgi?id=3973

  - add proftpd-sftp-kbdint-max-responses-bug3973.patch

  - Improve systemd service file 

  - use upstream tmpfiles.d file. related to [bnc#811793]

  - Use /run instead of /var/run 

  - update to 1.3.4c

  - Added Spanish translation.

  - Fixed several mod_sftp issues, including     SFTPPassPhraseProvider, handling of symlinks for     REALPATH requests, and response code logging.

  - Fixed symlink race for creating directories when     UserOwner is in effect.

  - Increased performance of FTP directory listings.

  - rebase and rename patches (remove version string)

  - proftpd-1.3.4a-dist.patch -> proftpd-dist.patch

  - proftpd-1.3.4a-ftpasswd.patch -> proftpd-ftpasswd.patch

  - proftpd-1.3.4a-strip.patch -> proftpd-strip.patch

  - fix proftpd.conf (rebase basic.conf patch)

  - IdentLookups is now a separate module <IfModule     mod_ident.c> IdentLookups on/off </IfModule> is needed     and module is not built cause crrodriguez disabled it.

  - fix for bnc#787884     (https://bugzilla.novell.com/show_bug.cgi?id=787884)

  - added extra Source proftpd.conf.tmpfile

  - Disable ident lookups, this protocol is totally obsolete     and dangerous. (add --disable-ident)

  - Fix debug info generation ( add --disable-strip) 

  - Add systemd unit 

  - update to 1.3.4b

  + Fixed mod_ldap segfault on login when LDAPUsers with no     filters used.

  + Fixed sporadic SFTP upload issues for large files.

  + Fixed SSH2 handling for some clients (e.g. OpenVMS).

  + New FactsOptions directive; see     doc/modules/mod_facts.html#FactsOptions

  + Fixed build errors on Tru64, AIX, Cygwin.

  - add Source Signatuire (.asc) file

  - add noBuildDate patch

  - add lang pkg

  - --enable-nls

  - add configure option

  - --enable-openssl, --with-lastlog

A vulnerability has been discovered and corrected in proftpd :

Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation (CVE-2013-4359).

The updated packages have been patched to correct this issue.

Kingcope discovered that the mod_sftp and mod_sftp_pam modules of proftpd, a powerful modular FTP/SFTP/FTPS server, are not properly validating input, before making pool allocations. An attacker can use this flaw to conduct denial of service attacks against the system running proftpd (resource exhaustion).

The remote host is affected by the vulnerability described in GLSA-201309-15 (ProFTPD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ProFTPD. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process, perform man-in-the-middle attacks to spoof       arbitrary SSL servers, cause a Denial of Service condition, or read and       modify arbitrary files.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
106754	ProFTPD 1.3.4d / 1.3.5rc3 Denial of Service	Nessus	FTP	medium
84134	openSUSE Security Update : proftpd (openSUSE-2015-410)	Nessus	SuSE Local Security Checks	critical
75173	openSUSE Security Update : proftpd (openSUSE-SU-2013:1563-1)	Nessus	SuSE Local Security Checks	medium
70300	Mandriva Linux Security Advisory : proftpd (MDVSA-2013:245)	Nessus	Mandriva Local Security Checks	medium
70201	Debian DSA-2767-1 : proftpd-dfsg - denial of service	Nessus	Debian Local Security Checks	medium
70111	GLSA-201309-15 : ProFTPD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2013-4359

high

Tenable Plugins

medium

critical

medium

medium

medium

critical