Vulnerability in N/a
CVE-2020-9273
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
EPSS: 0.602 (98.3th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- github.com/proftpd/proftpd/blob/master/RELEASE_NOTES (x_refsource_CONFIRM)
- github.com/proftpd/proftpd/issues/903 (x_refsource_CONFIRM)
- [debian-lts-announce] 20200221 [SECURITY] [DLA 2115-1] proftpd-dfsg security update (mailing-list, x_refsource_MLIST)
- DSA-4635 (vendor-advisory, x_refsource_DEBIAN)
- FEDORA-2020-76c707cff0 (vendor-advisory, x_refsource_FEDORA)
- FEDORA-2020-876b1f664e (vendor-advisory, x_refsource_FEDORA)
- openSUSE-SU-2020:0273 (vendor-advisory, x_refsource_SUSE)
- [debian-lts-announce] 20200302 [SECURITY] [DLA 2115-2] proftpd-dfsg regression update (mailing-list, x_refsource_MLIST)
- GLSA-202003-35 (vendor-advisory, x_refsource_GENTOO)
- cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2020-9273?
- CVE-2020-9273 is a vulnerability in N/a. Published 2020-02-20.
- Is CVE-2020-9273 known to be exploited?
- 13 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.