CVE-2020-9273

Published: Feb 20, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Affected (11)

Products: Proftpd: Proftpd · Debian: Debian Linux · Fedoraproject: Fedora · +2 more

Show all products

Proftpd: Proftpd · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Backports Sle, Leap · Siemens: Simatic Net Cp 1545 1 Firmware, Simatic Net Cp 1543 1 Firmware

1 product

1 product

1 product

2 products

2 products

Simatic Net Cp 1545 1 Firmware

Simatic Net Cp 1543 1 Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Proftpd Proftpd	Version 1.3.7

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Backports Sle	Version 15.0
Opensuse Backports Sle	Version 15.0 sp1
Opensuse Leap	Version 15.1

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1545 1 Firmware	All versions

Running on/with	Platform Versions
Siemens Simatic Net Cp 1545 1	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Net Cp 1543 1 Firmware	Before 3.0

Running on/with	Platform Versions
Siemens Simatic Net Cp 1543 1	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (24)

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/08/25/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/09/06/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf

Source: cve@mitre.org

Third Party Advisory

https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/proftpd/proftpd/issues/903

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/02/msg00022.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/03/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCUPRYSJR7XOM3HQ6H5M4OGDU7OHCHBF/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHO3S5WPRRP7VGKIAHLYQVEYW5HRYIJN/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202003-35

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4635

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00002.html