The remote ProFTPd server is as old or older than 1.2.0rc2

There is a very hard to exploit format string vulnerability in this version that could allow an attacker to execute arbitrary code on this host.

The vulnerability is believed to be nearly impossible to exploit though.

Wojciech Purczynski 氏は、ProFTPD FTP サーバーに、DoS 攻撃で使用される可能性のあるメモリ漏洩の問題があることを報告しました。スコアボードファイルが書き込み可能でない場合（デフォルトの Linux-Mandrake インストールでない場合）、SIZE コマンドが出されるたびに、メモリ漏洩が発生します。また、同様の問題が USER コマンドにも存在しており、コマンドが出されるたびに、サーバーが追加的にメモリを使用することになります。さらに、一部の書式文字列の脆弱性が Przemyslaw Frasunek 氏によって報告されており、これも修正されています。

ProFTPD FTP 服务器存在可在 DoS 攻击中利用的内存泄漏问题，此问题由 Wojciech Purczynski 报告。假设计分板文件不可写，每次发出 SIZE 命令时都将发生内存泄漏，默认 Linux-Mandrake 安装不会受到影响。每次发出 USER 命令时，服务器会使用更多的内存，也会存在类似的问题。此外，据 Przemyslaw Frasunek 报告还修复了某些格式字符串漏洞。

The ProFTPD FTP server has problems with memory leaking that could be used in a DoS attack, as reported by Wojciech Purczynski. A memory leak will happen every time a SIZE command was given provided that the scoreboard file is not writable, which is not the case in a default Linux-Mandrake installation. A similar problem also existed with the USER command where every time it was given the server would use more memory. Additionally, some format string vulnerabilities were reported by Przemyslaw Frasunek which have also been fixed.

The following problems have been reported for the version of proftpd in Debian 2.2 (potato) :

  - There is a memory leak in the SIZE command which can     result in a denial of service, as reported by Wojciech     Purczynski. This is only a problem if proftpd cannot     write to its scoreboard file; the default configuration     of proftpd in Debian is not vulnerable.
  - A similar memory leak affects the USER command, also as     reported by Wojciech Purczynski. The proftpd in Debian     2.2 is susceptible to this vulnerability; an attacker     can cause the proftpd daemon to crash by exhausting its     available memory.

  - There were some format string vulnerabilities reported     by Przemyslaw Frasunek. These are not known to have     exploits, but have been corrected as a precaution.

远程 ProFTPd 服务器版本等于或低于 1.2.0rc2

此软件存在一个可允许攻击者在此主机上执行任意代码且极难利用的格式字符串漏洞。

但据信，该漏洞几乎不可能利用。

根據 Wojciech Purczynski 的報告，ProFTPD FTP 伺服器有記憶體洩漏問題，可遭利用來發動 DoS 攻擊。計分板檔案不可寫入時，每次提供 SIZE 命令便會發生一個記憶體洩漏問題，預設的 Linux-Mandrake 安裝不會有此問題。USER 命令也有一個類似問題，每次執行該命令時，伺服器會使用更多的記憶體。此外，Przemyslaw Frasunek 報告的一些格式字串弱點也已修正。

The remote ProFTPd server is as old or older than 1.2.0rc2. There is a format string vulnerability in this version that might allow an attacker to execute arbitrary code on this host.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
11407	ProFTPD 1.2.0rc2 Malformed cwd Command Format String	Nessus	FTP	2003/3/17	2018/7/25	critical
61895	Mandrake Linux セキュリティアドバイザリ：proftpd（MDKSA-2001：021）	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	high
61895	Mandrake Linux 安全公告：proftpd (MDKSA-2001:021)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	high
61895	Mandrake Linux Security Advisory : proftpd (MDKSA-2001:021)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	high
14866	Debian DSA-029-2 : proftpd - remote DOS & potential buffer overflow	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	high
11407	ProFTPD 1.2.0rc2 畸形 cwd 命令格式字符串	Nessus	FTP	2003/3/17	2018/7/25	critical
61895	Mandrake Linux 安全性公告：proftpd (MDKSA-2001:021)	Nessus	Mandriva Local Security Checks	2012/9/6	2021/1/6	high
1818	ProFTPD cwd Command Format String	Nessus Network Monitor	FTP Servers	2004/8/20	2019/3/6	critical
801024	ProFTPD cwd Command Format String	Log Correlation Engine	FTP Servers			high

检测

插件搜索

critical

high

high

high

high

critical

high

critical

high