Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

Multiple directory traversal vulnerabilities in the modsitemisc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a (1) SITE MKDIR, (2) SITE RMDIR, (3) SITE SYMLINK, or (4) SITE UTIME command.

An integer overflow flaw was reported [1],[2] in the modsftp module of ProFTPD. If a specially crafted SSH message was sent to a ProFTPD server using modsftp, it could lead to the allocation of enormous amounts of memory and an eventual OOM termination by the kernel. This issue was assigned the name CVE-2011-1137 [3]. It was fixed in CVS [4],[5],[6]

References:

[1] http://bugs.proftpd.org/showbug.cgi?id=3586 [2] http://www.exploit-db.com/exploits/16129/ [3] http://www.openwall.com/lists/oss-security/2011/03/02/5 [4] http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/modsftp/packet.c?r1=1.14.2.2&r2=1.14.2.3 [5] http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/modsftp/packet.h?r1=1.3&r2=1.3.2.1 [6] http://proftp.cvs.sourceforge.net/viewvc/proftp/proftpd/contrib/modsftp/modsftp.c?r1=1.29.2.1&r2=1.29.2.2

The prdataxfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.

ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.