ProFTPD versions before 1.3.6b and various pre-release versions (1.3.7rc before 1.3.7rc2) are vulnerable to remote unauthenticated denial of service. The vulnerability occurs when processing overly long commands, causing an infinite loop in a child process that can crash the server.
PoC代码[已公开]
id: CVE-2019-18217
info:
name: ProFTPD < 1.3.6b - Remote Unauthenticated DoS
author: pussycat0x
severity: high
description: |
ProFTPD versions before 1.3.6b and various pre-release versions (1.3.7rc before 1.3.7rc2) are vulnerable to remote unauthenticated denial of service. The vulnerability occurs when processing overly long commands, causing an infinite loop in a child process that can crash the server.
reference:
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf
- https://github.com/proftpd/proftpd/blob/1.3.6/NEWS
- https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES
- https://github.com/proftpd/proftpd/blob/master/NEWS
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cvss-score: 7.5
cve-id: CVE-2019-18217
cwe-id: CWE-835
epss-score: 0.03991
epss-percentile: 0.87907
cpe: cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: proftpd
product: proftpd
shodan-query:
- product:"proftpd"
- cpe:"cpe:2.3:a:proftpd:proftpd"
tags: cve,cve2019,network,ftp,proftpd,tcp,passive,vuln
tcp:
- inputs:
- data: 00000000
type: hex
host:
- "{{Hostname}}"
port: 21
read-size: 1024
matchers:
- type: dsl
dsl:
- "contains(raw, 'ProFTPD')"
- "compare_versions(version, '< 1.3.6b')"
condition: and
extractors:
- type: regex
group: 1
name: version
regex:
- "ProFTPD ([0-9.a-z]+)"
# digest: 4a0a004730450220747d1c42f9d9b46a786a780c265d3db9219d58af42904574a468cbaf908a29ab022100ec6a1dd18e740204834bd346533ca7dc3d7333208db103d742bd87b821a7ba9d:922c64590222798bb761d5b6d8e72950