CVE-2013-4359

NONE EPSS 85.6%
Published Sep 30, 201312y ago · Modified Jun 16, 20262w ago
Find Similar
Published Sep 30, 2013 12y ago
Last Modified Jun 16, 2026 2w ago

Description

Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.

Threat Intelligence

EPSS Exploit Probability
85.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-189

Affected Products 2

VendorProductVersionRange
proftpdproftpd1.3.4any
proftpdproftpd1.3.5any

References 6

  • bugs.proftpd.org http://bugs.proftpd.org/show_bug.cgi?id=3973
    Patch
  • kingcope.wordpress.com http://kingcope.wordpress.com/2013/09/11/proftpd-mod_sftpmod_sftp_pam-invalid-pool-allocation-in-kbdint-authentication/
    Exploit
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-10/msg00032.html
  • lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
  • debian.org http://www.debian.org/security/2013/dsa-2767
  • openwall.com http://www.openwall.com/lists/oss-security/2013/09/17/6
    Exploit

Remediation