CVE-2003-0831 ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using...
HighCVSS 9.0
EPSS 56.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| proftpd project proftpd | = 1.2.7 | No fix listed |
| proftpd project proftpd | = 1.2.7_rc1 | No fix listed |
| proftpd project proftpd | = 1.2.7_rc2 | No fix listed |
| proftpd project proftpd | = 1.2.7_rc3 | No fix listed |
| proftpd project proftpd | = 1.2.8 | No fix listed |
| proftpd project proftpd | = 1.2.8_rc1 | No fix listed |
| proftpd project proftpd | = 1.2.8_rc2 | No fix listed |
| proftpd project proftpd | = 1.2.9_rc1 | No fix listed |
| proftpd project proftpd | = 1.2.9_rc2 | No fix listed |
References
- 20031014 Another ProFTPd root EXPLOIT ? mailing-list
- 20030924 [slackware-security] ProFTPD Security Advisory (SSA:2003-259-02) mailing-list
- 20031013 Remote root exploit for proftpd \n bug mailing-list
- 9829 third-party-advisory
- VU#405348 third-party-advisory us-government-resource
- MDKSA-2003:095 vendor-advisory
- 20030923 ProFTPD ASCII File Remote Compromise Vulnerability third-party-advisory
- proftpd-ascii-xfer-newline-bo(12200) vdb-entry
- 107 exploit