Detections
Analytics

ProFTPD 1.2.0rc2 Malformed cwd Command Format String

critical Nessus Plugin ID 11407

Language:

Synopsis

It might be possible to run arbitrary code on this server.

Description

The remote ProFTPd server is as old or older than 1.2.0rc2

There is a very hard to exploit format string vulnerability in this version that could allow an attacker to execute arbitrary code on this host.

The vulnerability is believed to be nearly impossible to exploit though.

Solution

Upgrade to a newer version.

Plugin Details

Severity: Critical

ID: 11407

File Name: proftpd_1_2_0_rc2.nasl

Version: 1.16

Type: remote

Family: FTP

Published: 3/17/2003

Updated: 7/25/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:proftpd:proftpd

Required KB Items: ftp/proftpd

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/10/2001

Reference Information

CVE: CVE-2001-0318

BID: 6781