CVE-2010-3867

ProFTPD’s mod_site_misc before 1.3.3c is affected by multiple directory-traversal vulnerabilities exploitable by remote authenticated users via SITE MKDIR, SITE RMDIR, SITE SYMLINK, or SITE UTIME to create/delete directories, create symlinks, or modify file timestamps. The CVE entry is corroborat...

CVE-2010-4221

Multiple stack-based buffer overflows in the prnetiotelnetgets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a 1 FTP or 2 FTPS server...

CVE-2010-4221: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in the prnetiotelnetgets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a 1 FTP or 2 FTPS server...

PT-2010-5369

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.3c Description The issue involves multiple stack-based buffer overflows in the pr netio telnet gets function, allowing remote attackers to execute arbitrary code. This can be achieved by sending vectors involving ...

CVE-2010-3867: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the modsitemisc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a 1 SITE MKDIR, 2 SITE RMDIR, 3 SITE SYMLINK...

PT-2010-5128

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.3c Description The issue allows remote authenticated users to perform unauthorized actions such as creating directories, deleting directories, creating symlinks, and modifying file timestamps. This is achieved...

PT-2010-1254

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.2rc3 Description The issue allows remote authenticated users to cause a denial of service, specifically CPU consumption, by sending an ABOR command during a data transfer. This is due to a problem in the pr data...

CVE-2008-7265: Undefined Security Weakness

The prdataxfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service CPU consumption via an ABOR command during a data transfer...

ProFTPD IAC Remote Root Exploit

Exploit Title: ProFTPD IAC Remote Root Exploit Date: 7 November 2010 Author: Kingcope use IO::Socket; $numtargets = 13; @targets = Plain Stack Smashing Confirmed to work "FreeBSD 8.1 i386, ProFTPD 1.3.3a Server binary", PLATFORM SPEC "FreeBSD", OPERATING SYSTEM 0, EXPLOIT STYLE 0xbfbfe000, OFFSET...

ProFTPD IAC Remote Root Exploit

Exploit for windows platform in category remote exploits =============================== ProFTPD IAC Remote Root Exploit =============================== Exploit Title: ProFTPD IAC Remote Root Exploit Date: 7 November 2010 Author: Kingcope use IO::Socket; $numtargets = 13; @targets = Plain Stack...

ProFTPd IAC 1.3.x - Remote Command Execution

ProFTPd IAC 1.3.x - Remote Command Execution Exploit Title: ProFTPD IAC Remote Root Exploit Date: 7 November 2010 Author: Kingcope E-DB Note: If you have issues with this exploit, alter lines 549, 555 and 563. use IO::Socket; $numtargets = 13; @targets = Plain Stack Smashing Confirmed to work...

ProFTPd IAC 1.3.x - Remote Command Execution

Exploit Title: ProFTPD IAC Remote Root Exploit Date: 7 November 2010 Author: Kingcope E-DB Note: If you have issues with this exploit, alter lines 549, 555 and 563. use IO::Socket; $numtargets = 13; @targets = Plain Stack Smashing Confirmed to work "FreeBSD 8.1 i386, ProFTPD 1.3.3a Server binary"...

ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow

$Id: proftptelnetiac.rb 10900 2010-11-04 18:12:11Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

ProFTPD多个模块目录遍历和缓冲区溢出漏洞

BUGTRAQ ID: 44562 CVE ID: CVE-2010-3867 ProFTPD是一款开放源代码FTP服务程序。 ProFTPD的src/netio.c文件中的prnetiotelnetgets函数在处理包含有Telnet IAC转义序列的用户输入时存在栈溢出，远程攻击者可以通过向FTP或FTPS服务提交恶意输入导致执行任意代码。 此外modsitemisc模块中存在多个输入验证错误，攻击者可以通过目录遍历攻击写入或删除任意目录、创建符号链接或更改文件时间。 ProFTPD Project ProFTPD 1.3.x 厂商补丁： ProFTPD Project...

[slackware-security] proftpd

New proftpd packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, and -current to a fix security issue. Here are the details from the Slackware 13.1 ChangeLog: patches/packages/proftpd-1.3.3c-i486-1slack13.1.txz: Upgraded. Fixed Telnet IAC stack overflow vulnerability...

ProFTPD TELNET_IAC Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ProFTPD. Authentication is not required to exploit this vulnerability. The flaw exists within the proftpd server component which listens by default on TCP port 21. When reading user input if a...

Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : proftpd (SSA:2010-305-03)

New proftpd packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, 13.1, and -current to a fix security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2010-305-03. The...

proftpd -- remote code execution vulnerability

Tippingpoint reports: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ProFTPD. Authentication is not required to exploit this vulnerability. The flaw exists within the proftpd server component which listens by default on TCP port 21. When readin...

ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)

This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code. The Debian Squeeze version of the exploit uses a litt...

ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)

This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code. Module Options msf use...