CVE-2023-51713

HIGHNuclei

ProFTPD < 1.3.8a - DoS via Out-of-Bounds Read

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-51713 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHProFTPD < 1.3.8a - DoS via Out-of-Bounds ReadCVSS 7.5

ProFTPD versions before 1.3.8a contain a one-byte out-of-bounds read vulnerability in the make_ftp_cmd function within main.c. This vulnerability can lead to a daemon crash, causing denial of service.

Impact

Attackers can crash the ProFTPD daemon by triggering an out-of-bounds read in the make_ftp_cmd function, causing service disruption and denying legitimate users access to FTP services.

Remediation

Upgrade to ProFTPD version 1.3.8a or later that fixes the out-of-bounds read vulnerability in the make_ftp_cmd function.

WeaknessesCWE-125
Authorspussycat0x
Template tagscvecve2023networkftpproftpdtcppassivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CPE: cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*
Shodan: product:"proftpd"
Shodan: cpe:"cpe:2.3:a:proftpd:proftpd"
https://github.com/proftpd/proftpd/blob/1.3.8/NEWS

Source: ProjectDiscovery

References

4