Bug 2344291 (CVE-2024-57392) - CVE-2024-57392 proftpd: Buffer Overflow in ProFTPD
Summary: CVE-2024-57392 proftpd: Buffer Overflow in ProFTPD
Keywords:
Status: NEW
Alias: CVE-2024-57392
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2344417 2344418
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-02-06 22:01 UTC by OSIDB Bzimport
Modified: 2025-02-10 15:11 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-02-06 22:01:27 UTC
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.

Comment 2 Paul Howarth 2025-02-09 10:30:54 UTC
Comment from upstream:
https://github.com/proftpd/proftpd/issues/1866#issuecomment-2645976560

I executed all of the provided test cases, and have verified the following:
* the test cases which trigger issues do so only for _data transfers_ (file uploaded/downloads, directory listings); data transfers require successfully authentication
* the test cases do _not_ require that the `--enable-devel=nodaemon:nofork` configure option be used
* the test cases trigger issues with NULL pointer dereferences; I found no sign of the purported "buffer overflow"

Thus any "denial of service" is self-inflicted; the process which dies due to the NULL pointer deference is the process handling that particular client connection, and no other clients or connections.

At this point, I am inclined to think this advisory was incompetently written/reported, and no one actually bothered to verify this before issuing the (IMHO, spurious and useless) CVE.


Note You need to log in before you can comment on or make changes to this bug.