ProFTPD < 1.3.0rc2 Multiple Remote Format Strings

medium Nessus Plugin ID 19302


The remote FTP server is affected by multiple vulnerabilities.


The remote host is using ProFTPD, a free FTP server for Unix and Linux.

According to its banner, the version of ProFTPD installed on the remote host suffers from multiple format string vulnerabilities, one involving the 'ftpshut' utility and the other in mod_sql's 'SQLShowInfo' directive. Exploitation of either requires involvement on the part of a site administrator and can lead to information disclosure, denial of service, and even a compromise of the affected system.


Upgrade to ProFTPD version 1.3.0rc2 or later.

See Also

Plugin Details

Severity: Medium

ID: 19302

File Name: proftpd_1_3_0_rc2.nasl

Version: 1.21

Type: remote

Family: FTP

Published: 7/27/2005

Updated: 7/25/2018

Configuration: Enable paranoid mode

Risk Information


Risk Factor: Medium

Score: 5.2


Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P

Vulnerability Information

CPE: cpe:/a:proftpd:proftpd

Required KB Items: Settings/ParanoidReport, ftp/proftpd

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/26/2005

Reference Information

CVE: CVE-2005-2390

BID: 14380, 14381