ProFTPD Heap-Based Buffer Overflow Vulnerability in mod_sftp Module Allowing Arbitrary Code Execution

A heap-based buffer overflow vulnerability has been identified in the ProFTPD FTP server software, specifically in versions prior to 1.3.9c and between 1.3.10rc1 and 1.3.10rc3. This vulnerability resides within the mod_sftp module and allows authenticated low-privilege attackers to execute arbitrary code. The issue arises when crafted SFTP packet fragments exceeding 16 KB are sent, exploiting an improperly managed reallocation process. This leads to corruption of the memory pool's metadata, overwriting critical pointers to redirect function calls to system commands, effectively allowing code execution.

Impact

Exploitation of this vulnerability could lead to unauthorized arbitrary code execution on the server.

Reproduction

The vulnerability can be reproduced by sending fragmented SFTP packets that collectively exceed the 16 KB buffer limit. After the initial fragmentation is acknowledged, a follow-up packet can be sent that triggers the buffer overflow by exceeding the allocated buffer size. This can be done by manipulating the SFTP 'RENAME' request to execute arbitrary commands on the server.

Remediation

Users can upgrade to ProFTPD versions 1.3.9c or 1.3.10rc3 and later, where this vulnerability has been fixed.