Searching proftpd software vulnerabilities

Buffer overflow in ProFTPD, wu-ftpd, and beroft

directories | attackers | beroftpd | overflow | commands | wu-ftpd | ProFTPD | access | series | create | allows | Buffer | nested | remote | root | gain | via | CWD | MKD |

Buffer overflow in ProFTPD, wu-ftpd, and beroftpd allows remote attackers to gain root access via a series of MKD and CWD commands that create nested directories.


ProFTPd 1.2 compiled with the mod_sqlpw module

privileges | passwords | mod_sqlpw | compiled | reading | command | ProFTPd | records | allows | obtain | module | users | local | which | wtmp | last | user | file | gain | log | via |

ProFTPd 1.2 compiled with the mod_sqlpw module records user passwords in the wtmp log file, which allows local users to obtain the passwords and gain privileges by reading wtmp, e.g. via the last command.


FTP servers such as OpenBSD ftpd, NetBSD ftpd,

setproctitle | untrusted | Opieftpd | properly | function | servers | cleanse | strings | ProFTPd | OpenBSD | format | NetBSD | used | ftpd | such | FTP | not |

FTP servers such as OpenBSD ftpd, NetBSD ftpd, ProFTPd and Opieftpd do not properly cleanse untrusted format strings that are used in the setproctitle function (sometimes called by set_proc_title), which allows remote attackers to cause a denial of service or execute arbitrary commands.


mod_sqlpw module in ProFTPD does not reset a ca

authenticated | privileges | mod_sqlpw | attackers | accounts | password | ProFTPD | command | change | allows | "user" | cached | module | users | other | reset | which | user | uses | does | gain | not |

mod_sqlpw module in ProFTPD does not reset a cached password when a user uses the "user" command to change accounts, which allows authenticated attackers to gain privileges of other users.


ProFTPD 1.2.2rc2, and possibly other versions,

reverse-resolved | resolution | performing | hostnames | incorrect | attackers | hostname | properly | possibly | versions | forward | ProFTPD | remote | bypass | 122rc2 | allows | verify | logged | client | cause | which | other | does | ACLs | not |

ProFTPD 1.2.2rc2, and possibly other versions, does not properly verify reverse-resolved hostnames by performing forward resolution, which allows remote attackers to bypass ACLs or cause an incorrect client hostname to be logged.


The glob functionality in ProFTPD 1.2.1, and po

functionality | ProFTPD | glob |

The glob functionality in ProFTPD 1.2.1, and possibly other versions allows remote attackers to cause a denial of service (CPU and memory consumption) via commands with large numbers of wildcard and other special characters, as demonstrated using an ls command with multiple (1) "*/..", (2) "*/.*", or (3) ".*./*?/" sequences in the argument.


SQL injection vulnerability in the PostgreSQL a

authentication | vulnerability | PostgreSQL | injection | module | SQL |

SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before 1.2.9rc1 allows remote attackers to execute arbitrary SQL and gain privileges by bypassing authentication or stealing passwords via the USER name.


ProFTPD 1.2.7 through 1.2.9rc2 does not properl

ProFTPD |

ProFTPD 1.2.7 through 1.2.9rc2 does not properly translate newline characters when transferring files in ASCII mode, which allows remote attackers to execute arbitrary code via a buffer overflow using certain files.


Off-by-one buffer overflow in _xlate_ascii_writ

Off-by-one | overflow | buffer |

Off-by-one buffer overflow in _xlate_ascii_write() in ProFTPD 1.2.7 through 1.2.9rc2p allows local users to gain privileges via a 1024 byte RETR command.


ProFTPD 1.2.9 treats the Allow and Deny directi

ProFTPD |

ProFTPD 1.2.9 treats the Allow and Deny directives for CIDR based ACL entries as if they were AllowAll, which could allow FTP clients to bypass intended access restrictions.


ProFTPD 1.2.x, including 1.2.8 and 1.2.10, resp

including | ProFTPD | 12x |

ProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given username exists, which allows remote attackers to identify valid usernames by timing the server response.


Format string vulnerability in gprostats for GP

vulnerability | gprostats | GProFTPD | before | Format | string |

Format string vulnerability in gprostats for GProFTPD before 8.1.9 may allow remote attackers to execute arbitrary code via an FTP transfer with a crafted filename that causes format string specifiers to be inserted into the ProFTPD transfer log.


Multiple format string vulnerabilities in ProFT

vulnerabilities | information | sensitive | attackers | Multiple | service | ProFTPD | obtain | denial | string | format | 130rc2 | before | allow | cause | via |

Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the shutdown message from ftpshut, or (2) the SQLShowInfo mod_sql directive.


Buffer overflow in mod_radius in ProFTPD before

mod_radius | attackers | overflow | ProFTPD | service | remote | denial | Buffer | before | allows | 130rc2 | cause |

Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.


Buffer overflow in the tls_x509_name_oneline fu

tls_x509_name_oneline | vulnerability | CVE-2006-5815 | different | arbitrary | attackers | overflow | possibly | products | function | argument | execute | ProFTPD | mod_tls | earlier | length | Buffer | module | remote | allows | large | other | used | than | code | data | 130a | via |

Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815.


** DISPUTED ** ProFTPD 1.3.0a and earlier does

CommandBufferSize | configuration | off-by-two | specified | underflow | properly | DISPUTED | earlier | ProFTPD | buffer | limit | which | leads | file | does | 130a | size | set | not |

** DISPUTED ** ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability.


Stack-based buffer overflow in the pr_ctrls_rec

pr_ctrls_recv_request | Stack-based | reqarglen | arbitrary | mod_ctrls | overflow | function | ProFTPD | execute | allows | length | module | buffer | ctrlsc | before | 131rc1 | large | local | users | value | code | via |

Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.


Cross-site scripting (XSS) vulnerability in JBM

Cross-site | scripting |

Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does not properly display log files, which allows remote authenticated users to inject arbitrary web script or HTML via (1) http or (2) ftp requests logged in /var/log/directadmin/security.log; (3) allows context-dependent attackers to inject arbitrary web script or HTML into /var/log/messages via a PHP script that invokes /usr/bin/logger; (4) allows local users to inject arbitrary web script or HTML into /var/log/messages by invoking /usr/bin/logger at the command line; and allows remote attackers to inject arbitrary web script or HTML via remote requests logged in the (5) /var/log/exim/rejectlog, (6) /var/log/exim/mainlog, (7) /var/log/proftpd/auth.log, (8) /var/log/httpd/error_log, (9) /var/log/httpd/access_log, (10) /var/log/directadmin/error.log, and (11) /var/log/directadmin/security.log files.


The Auth API in ProFTPD before 20070417, when m

ProFTPD | before | Auth | API |

The Auth API in ProFTPD before Tuesday, April 17, 2007, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd.


Software vulnerabilities results 1 to 20 of 20     
Page: 12►