Description
ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.4a-3 | — |
| Debian 13 | proftpd-dfsg | 1.3.4a-3 | — |
| Debian 12 | proftpd-dfsg | 1.3.4a-3 | — |
| Debian 6.0 | proftpd-dfsg | 1.3.3a-6squeeze6 | DSA-2606-1 |
Advisories 1
- DSA-2606-1 proftpd-dfsg - symlink race Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://proftpd.org/docs/NEWS-1.3.5rc1
- [oss-security] 20130107 Re: CVE Request -- proFTPD (X < 1.3.5.rc1): Symlink race condition when applying UserOwner to a newly (ProFTPD) created directory mailing-list
- http://bugs.proftpd.org/show_bug.cgi?id=3841
- 51823 third-party-advisory
- DSA-2606 vendor-advisory