Description
Memory leak in ProFTPd 1.2.0rc2 allows remote attackers to cause a denial of service via a series of USER commands, and possibly SIZE commands if the server has been improperly installed.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- ProFTPd 1.2.0 pre10 - Remote Denial of Service EDB-244 · dos · Jan 12, 2001 · verified
- ProFTPd 1.2.0 rc2 - Memory Leakage EDB-241 · dos · Jan 3, 2001 · verified
- ProFTPd 1.2 - 'SIZE' Remote Denial of Service EDB-20536 · dos · Dec 20, 2000 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- MDKSA-2001:021 vendor-advisory
- CLA-2001:380 vendor-advisory
- proftpd-size-memory-leak(5801) vdb-entry
- 20010109 Memory leakage in ProFTPd leads to remote DoS (SIZE FTP); (Exploit Code) mailing-list
- 20010110 Re: Memory leakage in ProFTPd leads to remote DoS (SIZE FTP); (Exploit Code) mailing-list
- 20010213 Trustix Security Advisory - proftpd, kernel mailing-list
- 20001220 ProFTPD 1.2.0 Memory leakage - denial of service mailing-list
- DSA-029 vendor-advisory