Description
ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.0-13 | — |
| Debian 13 | proftpd-dfsg | 1.3.0-13 | — |
| Debian 12 | proftpd-dfsg | 1.3.0-13 | — |
| Debian 3.1 | proftpd | 1.2.10-15sarge2 | DSA-1218-1 |
Advisories 1
- DSA-1218-1 proftpd Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-1222 vendor-advisory
- http://proftp.cvs.sourceforge.net/proftp/proftpd/src/main.c?r1=1.292&r2=1.293&sortby=date
- DSA-1218 vendor-advisory
- 23207 third-party-advisory
- SSA:2006-335-02 vendor-advisory
- 23174 third-party-advisory
- MDKSA-2006:217-1 vendor-advisory
- 2006-0070 vendor-advisory
- 23329 third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=214820
- 23184 third-party-advisory
- 23179 third-party-advisory
- GLSA-200611-26 vendor-advisory
- OpenPKG-SA-2006.035 vendor-advisory