Vulnerability CVE-2010-4221 - CERT Civis.Net

Vulnerability Name:

CVE-2010-4221 (CCN-62908)

Assigned:

2010-10-29

Published:

2010-10-29

Updated:

2011-09-15

Summary:

Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
8.3 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
8.3 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: ProFTPd Bugzilla Bug 3521
Telnet IAC processing stack overflow

Source: CONFIRM
Type: Exploit
http://bugs.proftpd.org/show_bug.cgi?id=3521

Source: MITRE
Type: CNA
CVE-2010-4221

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-17091

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-17098

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-17220

Source: CCN
Type: SA42052
ProFTPD Directory Traversal and Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
42052

Source: SECUNIA
Type: UNKNOWN
42217

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2010:227

Source: CCN
Type: OSVDB ID: 68985
ProFTPD netio.c pr_netio_telnet_gets Function TELNET_IAC Escape Sequence Remote Overflow

Source: CONFIRM
Type: UNKNOWN
http://www.proftpd.org/docs/NEWS-1.3.3c

Source: BID
Type: Exploit
44562

Source: CCN
Type: BID-44562
ProFTPD Multiple Remote Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2010-2941

Source: VUPEN
Type: UNKNOWN
ADV-2010-2959

Source: VUPEN
Type: UNKNOWN
ADV-2010-2962

Source: MISC
Type: UNKNOWN
http://www.zerodayinitiative.com/advisories/ZDI-10-229/

Source: XF
Type: UNKNOWN
proftpd-prnetiotelnelgets-bo(62908)

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [11-07-2010]

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [01-09-2011]

Source: CCN
Type: ZDI-10-229
ProFTPD TELNET_IAC Remote Code Execution Vulnerability

Vulnerable Configuration:

Configuration 1:

cpe:/a:proftpd:proftpd:1.3.2:*:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.2:a:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.2:b:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.2:c:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.2:d:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.2:e:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.2:rc3:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.2:rc4:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.3:*:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.3:a:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.3:b:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.3:rc1:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.3:rc2:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.3:rc3:*:*:*:*:*:*

OR cpe:/a:proftpd:proftpd:1.3.3:rc4:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:proftpd:proftpd:1.3.3:*:*:*:*:*:*:*

AND

cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:x86_64:*:*:*:*:*

OR cpe:/o:mandriva:linux:2009.0:*:*:*:*:*:*:*

OR cpe:/o:mandriva:linux:2009.0:-:x86_64:*:*:*:*:*

OR cpe:/o:mandriva:linux:2009.1:*:*:*:*:*:*:*

OR cpe:/o:mandriva:linux:2009.1:*:*:*:x86_64:*:*:*

OR cpe:/o:mandriva:enterprise_server:5:*:*:*:*:*:*:*

OR cpe:/o:mandriva:enterprise_server:5:*:*:*:x86_64:*:*:*

OR cpe:/o:mandriva:linux:2010:*:*:*:x86_64:*:*:*

OR cpe:/o:mandriva:linux:2010:*:*:*:*:*:*:*

Denotes that component is vulnerable