Description
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.3a-5 | — |
| Debian 13 | proftpd-dfsg | 1.3.3a-5 | — |
| Debian 12 | proftpd-dfsg | 1.3.3a-5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
exploit/linux/ftp/proftp_telnet_iac
-
ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
exploit/freebsd/ftp/proftp_telnet_iac
Exploit-DB 3
- ProFTPd 1.3.2 rc3 < 1.3.3b (Linux) - Telnet IAC Buffer Overflow (Metasploit) EDB-16851 · remote · Jan 9, 2011 · verified
- ProFTPd 1.3.2 rc3 < 1.3.3b (FreeBSD) - Telnet IAC Buffer Overflow (Metasploit) EDB-16878 · remote · Dec 2, 2010 · verified
- ProFTPd IAC 1.3.x - Remote Command Execution EDB-15449 · remote · Nov 7, 2010 · verified
GitHub 3 repositories
-
M41doror/cve-2010-4221 ★ 2 · Oct 28, 2017
This exploit was written to study some concepts, enjoy!
-
diegslva/cve-2010-4221-lab ★ 0 · Sep 8, 2026
From patch to RCE: hand-built exploit for CVE-2010-4221 (ProFTPD TELNET IAC stack overflow), with the full failure-driven journey documented
-
Mafiosohack/Offensive-lab-2 ★ 0 · Dec 5, 2025
Penetration test walkthrough on a vulnerable Ubuntu VM. Exploited the ProFTPD 1.3.3c backdoor (CVE-2010-4221) to gain root access and capture the flag. Includes Nmap enumeration, Metasploit payload s…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://www.proftpd.org/docs/NEWS-1.3.3c
- FEDORA-2010-17091 vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-10-229/
- 42217 third-party-advisory
- FEDORA-2010-17098 vendor-advisory
- FEDORA-2010-17220 vendor-advisory
- ADV-2010-2941 vdb-entry
- ADV-2010-2962 vdb-entry
- 42052 third-party-advisory
- http://bugs.proftpd.org/show_bug.cgi?id=3521
- MDVSA-2010:227 vendor-advisory
- 44562 vdb-entry
- ADV-2010-2959 vdb-entry