Description
Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.0-17 | — |
| Debian 13 | proftpd-dfsg | 1.3.0-17 | — |
| Debian 12 | proftpd-dfsg | 1.3.0-17 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 4
- ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (2) EDB-3333 · local · Feb 19, 2007 · verified
- ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (1) EDB-3330 · local · Feb 18, 2007 · verified
- ProFTPd 1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (PoC) EDB-2928 · dos · Dec 13, 2006 · verified
- ProFTPd - 'ftpdctl' 'pr_ctrls_connect' Local Overflow EDB-394 · local · Aug 13, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 21587 vdb-entry
- MDKSA-2006:232 vendor-advisory
- 20061213 CORE-2006-1127: ProFTPD Controls Buffer Overflow mailing-list
- http://www.proftpd.org/docs/NEWS-1.3.1rc1
- http://www.coresecurity.com/?module=ContentMod&action=item&id=1594
- 20070219 ProFTPD 1.3.0/1.3.0a (mod_ctrls support) Local Buffer Overflow Exploit mailing-list
- OpenPKG-SA-2006.039 vendor-advisory
- 3330 exploit
- 24163 third-party-advisory
- 23473 third-party-advisory
- GLSA-200702-02 vendor-advisory
- 23371 third-party-advisory
- ADV-2006-4998 vdb-entry
- 23392 third-party-advisory
- 20070221 Re: ProFTPD 1.3.0/1.3.0a (mod_ctrls support) Local Buffer Overflow Exploit mailing-list
- proftpd-controls-bo(30906) vdb-entry
- 2006-0074 vendor-advisory