CVE-2011-1137

Published: Mar 11, 2011Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.

Affected (65)

Products: Proftpd: Proftpd

1 product

Configuration A

65 vulnerable

Vulnerable Software	Affected Versions
Proftpd Proftpd	Up to 1.3.3
Proftpd Proftpd	Version 1.2.0
Proftpd Proftpd	Version 1.2.0 pre10
Proftpd Proftpd	Version 1.2.0 pre9
Proftpd Proftpd	Version 1.2.0 rc1
Proftpd Proftpd	Version 1.2.0 rc2
Proftpd Proftpd	Version 1.2.0 rc3
Proftpd Proftpd	Version 1.2.10
Proftpd Proftpd	Version 1.2.10 rc1
Proftpd Proftpd	Version 1.2.10 rc2
Proftpd Proftpd	Version 1.2.10 rc3
Proftpd Proftpd	Version 1.2.1
Proftpd Proftpd	Version 1.2.2
Proftpd Proftpd	Version 1.2.2 rc1
Proftpd Proftpd	Version 1.2.2 rc2
Proftpd Proftpd	Version 1.2.2 rc3
Proftpd Proftpd	Version 1.2.3
Proftpd Proftpd	Version 1.2.4
Proftpd Proftpd	Version 1.2.5
Proftpd Proftpd	Version 1.2.5 rc1
Proftpd Proftpd	Version 1.2.5 rc2
Proftpd Proftpd	Version 1.2.5 rc3
Proftpd Proftpd	Version 1.2.6
Proftpd Proftpd	Version 1.2.6 rc1
Proftpd Proftpd	Version 1.2.6 rc2
Proftpd Proftpd	Version 1.2.7
Proftpd Proftpd	Version 1.2.7 rc1
Proftpd Proftpd	Version 1.2.7 rc2
Proftpd Proftpd	Version 1.2.7 rc3
Proftpd Proftpd	Version 1.2.8
Proftpd Proftpd	Version 1.2.8 rc1
Proftpd Proftpd	Version 1.2.8 rc2
Proftpd Proftpd	Version 1.2.9
Proftpd Proftpd	Version 1.2.9 rc1
Proftpd Proftpd	Version 1.2.9 rc2
Proftpd Proftpd	Version 1.2.9 rc3
Proftpd Proftpd	Version 1.3.0
Proftpd Proftpd	Version 1.3.0 a
Proftpd Proftpd	Version 1.3.0 rc1
Proftpd Proftpd	Version 1.3.0 rc2
Proftpd Proftpd	Version 1.3.0 rc3
Proftpd Proftpd	Version 1.3.0 rc4
Proftpd Proftpd	Version 1.3.0 rc5
Proftpd Proftpd	Version 1.3.1
Proftpd Proftpd	Version 1.3.1 rc1
Proftpd Proftpd	Version 1.3.1 rc2
Proftpd Proftpd	Version 1.3.1 rc3
Proftpd Proftpd	Version 1.3.2
Proftpd Proftpd	Version 1.3.2 a
Proftpd Proftpd	Version 1.3.2 b
Proftpd Proftpd	Version 1.3.2 c
Proftpd Proftpd	Version 1.3.2 d
Proftpd Proftpd	Version 1.3.2 e
Proftpd Proftpd	Version 1.3.2 rc1
Proftpd Proftpd	Version 1.3.2 rc2
Proftpd Proftpd	Version 1.3.2 rc3
Proftpd Proftpd	Version 1.3.2 rc4
Proftpd Proftpd	Version 1.3.3
Proftpd Proftpd	Version 1.3.3 a
Proftpd Proftpd	Version 1.3.3 b
Proftpd Proftpd	Version 1.3.3 c
Proftpd Proftpd	Version 1.3.3 rc1
Proftpd Proftpd	Version 1.3.3 rc2
Proftpd Proftpd	Version 1.3.3 rc3
Proftpd Proftpd	Version 1.3.3 rc4

Related CWEs

References (34)

http://bugs.proftpd.org/show_bug.cgi?id=3586

Source: cve@mitre.org

Patch

http://bugs.proftpd.org/show_bug.cgi?id=3587

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058344.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058356.html

Source: cve@mitre.org

http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/mod_sftp/mod_sftp.c?r1=1.29.2.1&r2=1.29.2.2

Source: cve@mitre.org

Patch

http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/mod_sftp/packet.c?r1=1.14.2.2&r2=1.14.2.3

Source: cve@mitre.org

Vendor Advisory

http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/mod_sftp/packet.h?r1=1.3&r2=1.3.2.1

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/43234

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/43635

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/43978

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.485806

Source: cve@mitre.org

http://www.debian.org/security/2011/dsa-2185

Source: cve@mitre.org

http://www.exploit-db.com/exploits/16129/

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/bid/46183

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2011/0617

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0857

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=681718

Source: cve@mitre.org

ExploitPatch

http://bugs.proftpd.org/show_bug.cgi?id=3586

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://bugs.proftpd.org/show_bug.cgi?id=3587

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058344.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058356.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/mod_sftp/mod_sftp.c?r1=1.29.2.1&r2=1.29.2.2

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/mod_sftp/packet.c?r1=1.14.2.2&r2=1.14.2.3

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/mod_sftp/packet.h?r1=1.3&r2=1.3.2.1

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43234

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43635

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/43978

Source: af854a3a-2127-422b-91ae-364da2661108

http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.485806

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2185

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/16129/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.securityfocus.com/bid/46183

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.vupen.com/english/advisories/2011/0617

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2011/0857

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=681718

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.