ProFTPD < 1.3.6b - Remote Unauthenticated DoS

highseverity

7.5CVSS score

20.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

ProFTPD versions before 1.3.6b and various pre-release versions (1.3.7rc before 1.3.7rc2) are vulnerable to remote unauthenticated denial of service. The vulnerability occurs when processing overly long commands, causing an infinite loop in a child process that can crash the server.

Impact

Unauthenticated attackers can send overly long FTP commands to cause infinite loop in a child process, leading to denial of service by crashing the ProFTPD server.

Fix

Update ProFTPD to version 1.3.6b or later that properly validates command length and prevents infinite loop conditions in command processing.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains(raw, 'ProFTPD') and compare_versions(version, '< 1.3.6b')

Run it with nuclei: nuclei -id CVE-2019-18217 -u <target>

The full check

id: CVE-2019-18217

info:
  name: ProFTPD < 1.3.6b - Remote Unauthenticated DoS
  author: pussycat0x
  severity: high
  description: |
    ProFTPD versions before 1.3.6b and various pre-release versions (1.3.7rc before 1.3.7rc2) are vulnerable to remote unauthenticated denial of service. The vulnerability occurs when processing overly long commands, causing an infinite loop in a child process that can crash the server.
  impact: |
    Unauthenticated attackers can send overly long FTP commands to cause infinite loop in a child process, leading to denial of service by crashing the ProFTPD server.
  remediation: |
    Update ProFTPD to version 1.3.6b or later that properly validates command length and prevents infinite loop conditions in command processing.
  reference:
    - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00009.html
    - https://cert-portal.siemens.com/productcert/pdf/ssa-940889.pdf
    - https://github.com/proftpd/proftpd/blob/1.3.6/NEWS
    - https://github.com/proftpd/proftpd/blob/1.3.6/RELEASE_NOTES
    - https://github.com/proftpd/proftpd/blob/master/NEWS
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2019-18217
    cwe-id: CWE-835
    epss-score: 0.2025
    epss-percentile: 0.9749
    cpe: cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: proftpd
    product: proftpd
    shodan-query:
      - product:"proftpd"
      - cpe:"cpe:2.3:a:proftpd:proftpd"
  tags: cve,cve2019,network,ftp,proftpd,tcp,passive,vuln

tcp:
  - inputs:
      - data: 00000000
        type: hex

    host:
      - "{{Hostname}}"
    port: 21
    read-size: 1024

    matchers:
      - type: dsl
        dsl:
          - "contains(raw, 'ProFTPD')"
          - "compare_versions(version, '< 1.3.6b')"
        condition: and

    extractors:
      - type: regex
        group: 1
        name: version
        regex:
          - "ProFTPD ([0-9.a-z]+)"

References

Use this check only on systems you are authorised to test. Where the data comes from