ProFTPD Integer Overflow Vulnerability in mod_sftp Module Allows ASLR Bypass and Memory Corruption Exploitation

A signed integer overflow vulnerability has been identified in the ProFTPD FTP server software, specifically in versions prior to 1.3.9c and between 1.3.10rc1 and 1.3.10rc3. The vulnerability resides in the mod_sftp module's SCP size-record parser, where it allows authenticated low-privilege attackers to manipulate the file size value. By sending a crafted value of UINT64_MAX, the attacker can cause a negative off_t value, which is then converted to uint32_t. This conversion results in an approximately 4 GB read request, forcing the server to read beyond the end of the SSH channel data. The overread process memory is then written into the uploaded file. In tested scenarios, the extracted data includes pointers to libc, libcrypto, and the Position Independent Executable (PIE), which can be used to derive their randomized base addresses. This capability bypasses Address Space Layout Randomization (ASLR) and enables reliable exploitation of memory corruption vulnerabilities within the same process.

Impact

Exploitation of this vulnerability bypasses ASLR and allows for the reliable exploitation of memory corruption vulnerabilities in the same process.

Reproduction

To reproduce this vulnerability, an authenticated low-privilege user can upload a file via SCP while specifying a file size value of UINT64_MAX. This crafted size will trigger the integer overflow in the size-record parser, leading to the described exploitation.

Remediation

Users can upgrade to ProFTPD versions 1.3.9c or 1.3.10rc3 and later, where this vulnerability has been addressed.