CVE-2011-4130 Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data trans...
HighCVSS 9.0
EPSS 12.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/proftpd-dfsg(Debian:12) | < 1.3.4~rc3-2 | 1.3.4~rc3-2 |
| debian/proftpd-dfsg(Debian:13) | < 1.3.4~rc3-2 | 1.3.4~rc3-2 |
| debian/proftpd-dfsg(Debian:14) | < 1.3.4~rc3-2 | 1.3.4~rc3-2 |
| proftpd | <= 1.3.3 | No fix listed |
| proftpd | = 1.2.0 | No fix listed |
| proftpd | = 1.2.0-pre10 | No fix listed |
| proftpd | = 1.2.0-pre9 | No fix listed |
| proftpd | = 1.2.0-rc1 | No fix listed |
| proftpd | = 1.2.0-rc2 | No fix listed |
| proftpd | = 1.2.0-rc3 | No fix listed |
| proftpd | = 1.2.1 | No fix listed |
| proftpd | = 1.2.2 | No fix listed |
| proftpd | = 1.2.2-rc1 | No fix listed |
| proftpd | = 1.2.2-rc2 | No fix listed |
| proftpd | = 1.2.2-rc3 | No fix listed |
| proftpd | = 1.2.3 | No fix listed |
| proftpd | = 1.2.4 | No fix listed |
| proftpd | = 1.2.5 | No fix listed |
| proftpd | = 1.2.5-rc1 | No fix listed |
| proftpd | = 1.2.5-rc2 | No fix listed |
| proftpd | = 1.2.5-rc3 | No fix listed |
| proftpd | = 1.2.6 | No fix listed |
| proftpd | = 1.2.6-rc1 | No fix listed |
| proftpd | = 1.2.6-rc2 | No fix listed |
| proftpd | = 1.2.7 | No fix listed |
Show 40 more
| Product | Affected versions | Fixed in |
|---|---|---|
| proftpd | = 1.2.7-rc1 | No fix listed |
| proftpd | = 1.2.7-rc2 | No fix listed |
| proftpd | = 1.2.7-rc3 | No fix listed |
| proftpd | = 1.2.8 | No fix listed |
| proftpd | = 1.2.8-rc1 | No fix listed |
| proftpd | = 1.2.8-rc2 | No fix listed |
| proftpd | = 1.2.9 | No fix listed |
| proftpd | = 1.2.9-rc1 | No fix listed |
| proftpd | = 1.2.9-rc2 | No fix listed |
| proftpd | = 1.2.9-rc3 | No fix listed |
| proftpd | = 1.2.10 | No fix listed |
| proftpd | = 1.2.10-rc1 | No fix listed |
| proftpd | = 1.2.10-rc2 | No fix listed |
| proftpd | = 1.2.10-rc3 | No fix listed |
| proftpd | = 1.3.0 | No fix listed |
| proftpd | = 1.3.0-a | No fix listed |
| proftpd | = 1.3.0-rc1 | No fix listed |
| proftpd | = 1.3.0-rc2 | No fix listed |
| proftpd | = 1.3.0-rc3 | No fix listed |
| proftpd | = 1.3.0-rc4 | No fix listed |
| proftpd | = 1.3.0-rc5 | No fix listed |
| proftpd | = 1.3.1 | No fix listed |
| proftpd | = 1.3.1-rc1 | No fix listed |
| proftpd | = 1.3.1-rc2 | No fix listed |
| proftpd | = 1.3.1-rc3 | No fix listed |
| proftpd | = 1.3.2 | No fix listed |
| proftpd | = 1.3.2-rc1 | No fix listed |
| proftpd | = 1.3.2-rc2 | No fix listed |
| proftpd | = 1.3.2-rc3 | No fix listed |
| proftpd | = 1.3.2-rc4 | No fix listed |
| proftpd | = 1.3.3 | No fix listed |
| proftpd | = 1.3.3-a | No fix listed |
| proftpd | = 1.3.3-b | No fix listed |
| proftpd | = 1.3.3-c | No fix listed |
| proftpd | = 1.3.3-d | No fix listed |
| proftpd | = 1.3.3-e | No fix listed |
| proftpd | = 1.3.3-rc1 | No fix listed |
| proftpd | = 1.3.3-rc2 | No fix listed |
| proftpd | = 1.3.3-rc3 | No fix listed |
| proftpd | = 1.3.3-rc4 | No fix listed |
References
- Debian Security Tracker CVE-2011-4130 vendor-advisory
- bugs.proftpd.org exploit patch
- www.proftpd.org
- 50631 vdb-entry
- www.zerodayinitiative.com
- bugs.debian.org issue-tracking