CVE-2011-1137: Integer Overflow
An integer overflow flaw was reported [1],[2] in the modsftp module of ProFTPD. If a specially crafted SSH message was sent to a ProFTPD server using modsftp, it could lead to the allocation of enormous amounts of memory and an eventual OOM termination by the kernel. This issue was assigned the name CVE-2011-1137 [3]. It was fixed in CVS [4],[5],[6]
References:
[1] http://bugs.proftpd.org/showbug.cgi?id=3586 [2] http://www.exploit-db.com/exploits/16129/ [3] http://www.openwall.com/lists/oss-security/2011/03/02/5 [4] http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/modsftp/packet.c?r1=1.14.2.2&r2=1.14.2.3 [5] http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/modsftp/packet.h?r1=1.3&r2=1.3.2.1 [6] http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/modsftp/modsftp.c?r1=1.29.2.1&r2=1.29.2.2
Other sources
Integer overflow in the modsftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1137?
CVE-2011-1137 is classified as a high severity vulnerability due to its potential to cause an out-of-memory (OOM) termination in affected ProFTPD servers.
How do I fix CVE-2011-1137?
To fix CVE-2011-1137, you should upgrade to a version of ProFTPD that is newer than 1.3.3 or any available patch provided by the vendor.
What versions of ProFTPD are affected by CVE-2011-1137?
CVE-2011-1137 affects ProFTPD versions up to and including 1.3.3, as well as specific earlier versions such as 1.2.0 through 1.2.10.
What impact can CVE-2011-1137 have on a ProFTPD server?
If exploited, CVE-2011-1137 can lead to the server consuming excessive memory, potentially resulting in a denial-of-service condition.
Is CVE-2011-1137 exploitable remotely?
Yes, CVE-2011-1137 is remotely exploitable through specially crafted SSH messages sent to a vulnerable ProFTPD server.