proftpd: stack-based buffer overflow [LWN.net]

Package(s):

proftpd

CVE #(s):

CVE-2006-6563

Created:

December 18, 2006

Updated:

February 14, 2007

Description:

A vulnerability exists in the FTP server ProFTPD, versions up to and including 1.3.0a. The vulnerability is caused by a stack-based buffer overflow in the "pr_ctrls_recv_request" function of the "Controls" feature. This is an optional feature of ProFTPD server which is by default disabled in OpenPKG and probably other distributions.

Alerts:

Gentoo	200702-02	2007-02-13
Trustix	TSLSA-2006-0074	2006-12-22
Mandriva	MDKSA-2006:232	2006-12-18
OpenPKG	OpenPKG-SA-2006.039	2006-12-18

(Log in to post comments)

proftpd: stack-based buffer overflow

Posted Mar 11, 2007 19:50 UTC (Sun) by kreutzm (guest, #4700) [Link]

Debian Sarge is not vulnerable as the code affected is not activated in the binary build.