Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.

The remote host is using ProFTPD, a free FTP server for Unix and Linux.
According to its banner, the version of ProFTPD installed on the remote host is earlier than 1.3.4rc2 and is affected by a Denial of Service vulnerability in the mod_sftp module.

The remote host is affected by the vulnerability described in GLSA-201309-15 (ProFTPD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ProFTPD. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process, perform man-in-the-middle attacks to spoof       arbitrary SSL servers, cause a Denial of Service condition, or read and       modify arbitrary files.
  Workaround :

    There is no known workaround at this time.

The second release candidate for proftpd 1.3.4.

This includes fixes for a number of security issues :

  - Plaintext command injection vulnerability in FTPS     implementation

    - Badly formed SSH messages cause DoS

    - Limit recursion depth for untrusted regular       expressions (#673040)

The update also contains a large number of bug fixes over release candidate 1, plus new support for SSL session caching using memcached.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update, to the current upstream maintenance release, fixes a large number of bugs (see NEWS for details), and also a couple of security issues :

  - Plaintext command injection vulnerability in FTPS     implementation (i.e. mod_tls). See     http://bugs.proftpd.org/show_bug.cgi?id=3624 for     details.

  - CVE-2011-1137 (badly formed SSH messages cause DoS). See     http://bugs.proftpd.org/show_bug.cgi?id=3586 for     details.

Other highlights include :

  - Display messages work properly again.

  - Performance improvements, especially during server     startup/restarts.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New proftpd packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix security issues.

A vulnerability was discovered and corrected in proftpd :

Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message (CVE-2011-1137).

Additionally for Mandriva Linux 2010.0 proftpd was upgraded to the same version as in Mandriva Linux 2010.2.

The updated packages have been patched to correct this issue.

It was discovered that an integer overflow in the SFTP file transfer module of the ProFTPD daemon could lead to denial of service.

The oldstable distribution (lenny) is not affected.

ID	Name	Product	Family	Severity
106753	ProFTPD < 1.3.4rc2 client-hostname restriction bypass	Nessus	FTP	medium
70111	GLSA-201309-15 : ProFTPD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
53460	Fedora 15 : proftpd-1.3.4-0.8.rc2.fc15 (2011-5098)	Nessus	Fedora Local Security Checks	medium
53459	Fedora 14 : proftpd-1.3.3e-1.fc14 (2011-5040)	Nessus	Fedora Local Security Checks	medium
53458	Fedora 13 : proftpd-1.3.3e-1.fc13 (2011-5033)	Nessus	Fedora Local Security Checks	medium
53298	Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : proftpd (SSA:2011-095-01)	Nessus	Slackware Local Security Checks	medium
52729	Mandriva Linux Security Advisory : proftpd (MDVSA-2011:047)	Nessus	Mandriva Local Security Checks	medium
52600	Debian DSA-2185-1 : proftpd-dfsg - integer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-1137

high

Tenable Plugins

medium

critical

medium

medium

medium

medium

medium

medium