Out-of-bounds read in ProFTPD - CVE-2023-51713

Vulnerability identifier: #VU84847

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-51713

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the make_ftp_cmd() function in main.c. A remote user can pass a specially crafted command to the server, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

ProFTPD
Fedora
openEuler
Ubuntu
proftpd
proftpd-basic (Ubuntu package)
proftpd-core (Ubuntu package)
proftpd-devel
proftpd-sqlite
proftpd-ldap
proftpd-utils
proftpd-debuginfo
proftpd-mysql
proftpd-debugsource
proftpd-postgresql

Install updates from vendor's website.

ProFTPD - update to 1.3.8a
proftpd - update to 1.3.6e-6.el8
proftpd-basic (Ubuntu package) - addressed in versions 1.3.6c-2ubuntu0.1, 1.3.7c+dfsg-1ubuntu0.1
proftpd-core (Ubuntu package) - addressed in versions 1.3.7c+dfsg-1ubuntu0.1, 1.3.8.b+dfsg-1ubuntu0.1, 1.3.8.b+dfsg-2ubuntu1.24.10.1
proftpd - update to 1.3.8b-2
proftpd-devel - update to 1.3.8b-2
proftpd-sqlite - update to 1.3.8b-2
proftpd-ldap - update to 1.3.8b-2
proftpd-utils - update to 1.3.8b-2
proftpd-debuginfo - update to 1.3.8b-2
proftpd-mysql - update to 1.3.8b-2
proftpd-debugsource - update to 1.3.8b-2
proftpd-postgresql - update to 1.3.8b-2

• https://github.com/proftpd/proftpd/issues/1683
• https://github.com/proftpd/proftpd/issues/1683#issuecomment-1712887554
• https://github.com/proftpd/proftpd/blob/1.3.8/NEWS

• Denial of service in ProFTPD
• Fedora EPEL 8 update for proftpd
• openEuler update for proftpd
• Ubuntu update for proftpd-dfsg