Stack-based buffer overflow in ProFTPD - CVE-2010-4221

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2010-4221

Links to Public Exploits and PoC-codes

• Exploit #11701 - ProFTPd 1.3.2rc3 < 1.3.3b (FreeBSD) - Telnet IAC Buffer Overflow (Metasploit) (June 23, 2025)
• Exploit #11702 - ProFTPd 1.3.2rc3 < 1.3.3b (Linux) - Telnet IAC Buffer Overflow (Metasploit) (June 23, 2025)
• Exploit #11703 - ProFTPd IAC 1.3.x - Remote Command Execution (June 23, 2025)
• Exploit #11700 - ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD) (June 23, 2025)
• Exploit #11699 - ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux) (June 23, 2025)

External References

• http://bugs.proftpd.org/show_bug.cgi?id=3521
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050687.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050703.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050726.html
• http://secunia.com/advisories/42052
• http://secunia.com/advisories/42217
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:227
• http://www.proftpd.org/docs/NEWS-1.3.3c
• http://www.securityfocus.com/bid/44562
• http://www.vupen.com/english/advisories/2010/2941
• http://www.vupen.com/english/advisories/2010/2959
• http://www.vupen.com/english/advisories/2010/2962
• http://www.zerodayinitiative.com/advisories/ZDI-10-229/

Related Security Bulletins

• Stack-based buffer overflow in ProFTPD
• Fedora EPEL 5 update for proftpd