1. CVE-Search
  2. CVE-2020-9273
ID CVE-2020-9273
Summary In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.
References
Vulnerable Configurations
  • cpe:2.3:a:proftpd:proftpd:1.3.7:*:*:*:*:*:*:*
    cpe:2.3:a:proftpd:proftpd:1.3.7:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
    cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
  • cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
    cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
  • cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
    cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
  • cpe:2.3:o:siemens:simatic_net_cp_1545-1_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:siemens:simatic_net_cp_1545-1_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:simatic_net_cp_1545-1:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:simatic_net_cp_1545-1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:siemens:simatic_net_cp_1543-1_firmware:2.2:*:*:*:*:*:*:*
    cpe:2.3:o:siemens:simatic_net_cp_1543-1_firmware:2.2:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:simatic_net_cp_1543-1:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:simatic_net_cp_1543-1:-:*:*:*:*:*:*:*
CVSS
Base: 9.0 (as of 14-09-2021 - 12:43)
Impact:
Exploitability:
CWE CWE-416
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:S/C:C/I:C/A:C
refmap via4
confirm
debian DSA-4635
fedora
  • FEDORA-2020-76c707cff0
  • FEDORA-2020-876b1f664e
gentoo GLSA-202003-35
mlist
  • [debian-lts-announce] 20200221 [SECURITY] [DLA 2115-1] proftpd-dfsg security update
  • [debian-lts-announce] 20200302 [SECURITY] [DLA 2115-2] proftpd-dfsg regression update
suse openSUSE-SU-2020:0273
Last major update 14-09-2021 - 12:43
Published 20-02-2020 - 16:15
Last modified 14-09-2021 - 12:43
Back to Top