In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote host is affected by the vulnerability described in GLSA-202003-35 (ProFTPd: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ProFTPd. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by interrupting the data transfer channel, could       possibly execute arbitrary code with the privileges of the process or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for proftpd fixes the following issues :

proftpd was updated to version 1.3.6c.

Security issues fixed :

  - CVE-2020-9272: Fixed an out-of-bounds read in mod_cap     (bsc#1164572).

  - CVE-2020-9273: Fixed a potential memory corruption     caused by an interruption of the data transfer channel     (bsc#1164574).

This update, to the current upstream stable release version, is a cumulative bug-fix release including a security fix for a use-after-free vulnerability (CVE-2020-9273): successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Antonio Morales discovered an use-after-free flaw in the memory pool allocator in ProFTPD, a powerful modular FTP/SFTP/FTPS server.
Interrupting current data transfers can corrupt the ProFTPD memory pool, leading to denial of service, or potentially the execution of arbitrary code.

It was discovered that there was a regression in a previous fix for a use-after-free vulnerability in the proftpd-dfsg FTP server.

Exploitation of the original vulnerability within the memory pool handling could have allowed a remote attacker to execute arbitrary code on the affected system. However, the fix that was released in proftpd-dfsg version 1.3.5e+r1.3.5-2+deb8u6 had a regression around the handling of log formatting.

For more information, please see :

https://github.com/proftpd/proftpd/issues/903

For Debian 8 'Jessie', this issue has been fixed in proftpd-dfsg version 1.3.5e+r1.3.5-2+deb8u7.

We recommend that you upgrade your proftpd-dfsg packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
501099	Siemens SIMATIC CP Use After Free (CVE-2020-9273)	Tenable OT Security	Tenable.ot	high
134641	GLSA-202003-35 : ProFTPd: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
134196	openSUSE Security Update : proftpd (openSUSE-2020-273)	Nessus	SuSE Local Security Checks	high
134137	Fedora 31 : proftpd (2020-876b1f664e)	Nessus	Fedora Local Security Checks	high
134135	Fedora 30 : proftpd (2020-76c707cff0)	Nessus	Fedora Local Security Checks	high
134095	Debian DSA-4635-1 : proftpd-dfsg - security update	Nessus	Debian Local Security Checks	high
133876	Debian DLA-2115-2 : proftpd-dfsg regression update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-9273

high

Tenable Plugins

high

high

high

high

high

high

high