SB2020022709 - Multiple vulnerabilities in Pure-FTPd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020022709

SB2020022709 - Multiple vulnerabilities in Pure-FTPd

Published: February 27, 2020 Updated: June 21, 2025

Security Bulletin ID SB2020022709
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2020-9365)

The vulnerability allows a remote authenticated user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the pure_strcmp function in utils.c. A remote authenticated user can use a specially crafted FTP command to trigger out-of-bounds read error and read contents of memory on the system.

2) Access of Uninitialized Pointer (CVE-ID: CVE-2020-9274)

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to access to an uninitialized pointer in init_aliases() function in diraliases.c when processing liked. A remote user with ability to create aliases can crash the server.


3) Resource exhaustion (CVE-ID: CVE-2019-20176)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a stack exhaustion issue in the listdir() function in ls.c. A remote authenticated user can use a specially crafted LS command to perform a denial of service (DoS) attack.


4) Arbitrary file upload (CVE-ID: CVE-2021-40524)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)


Remediation

Install update from vendor's website.

References