Description
Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.0-15 | — |
| Debian 13 | proftpd-dfsg | 1.3.0-15 | — |
| Debian 12 | proftpd-dfsg | 1.3.0-15 | — |
| Debian 3.1 | proftpd | 1.2.10-15sarge3 | DSA-1222-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | proftpd | 1.3.6e-1.10 | openSUSE-SU-2024:11196-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)
exploit/linux/ftp/proftp_sreplace
Exploit-DB 2
- ProFTPd 1.2 < 1.3.0 (Linux) - 'sreplace' Remote Buffer Overflow (Metasploit) EDB-16852 · remote · Jan 9, 2011 · verified
- ProFTPd 1.3.0 - 'sreplace' Remote Stack Overflow (Metasploit) EDB-2856 · remote · Nov 27, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- DSA-1222-1 proftpd Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11196-1 proftpd-1.3.6e-1.10 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- ADV-2006-4451 vdb-entry
- http://gleg.net/vulndisco_meta.shtml
- DSA-1222 vendor-advisory
- MDKSA-2006:217 vendor-advisory
- 23207 third-party-advisory
- SSA:2006-335-02 vendor-advisory
- 2006-0066 vendor-advisory
- 20061127 CVE-2006-5815: remote code execution in ProFTPD mailing-list
- 1017167 vdb-entry
- OpenPKG-SA-2006.035 vendor-advisory
- 23174 third-party-advisory
- MDKSA-2006:217-1 vendor-advisory
- proftpd-code-execution(30147) vdb-entry
- 2006-0070 vendor-advisory
- 23069 third-party-advisory
- 23000 third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=214820
- 22821 third-party-advisory
- 23184 third-party-advisory
- 23125 third-party-advisory
- 20992 vdb-entry
- http://bugs.proftpd.org/show_bug.cgi?id=2858
- 23179 third-party-advisory
- GLSA-200611-26 vendor-advisory
- 22803 third-party-advisory