Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 357535

Summary: net-ftp/proftpd: integer overflow in mod_sftp (CVE-2011-1137)
Product: Gentoo Security Reporter: Paweł Hajdan, Jr. (RETIRED) <phajdan.jr>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: minor CC: bernd, voyageur
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3? [upstream/ebuild?]
Package list:
Runtime testing required: ---

Description Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-03-05 15:03:21 UTC
An integer overflow flaw was reported [1],[2] in the mod_sftp module of
ProFTPD.  If a specially crafted SSH message was sent to a ProFTPD server using
mod_sftp, it could lead to the allocation of enormous amounts of memory and an
eventual OOM termination by the kernel.  This issue was assigned the name
CVE-2011-1137 [3].  It was fixed in CVS [4],[5],[6]


Comment 1 Tim Sammut (RETIRED) gentoo-dev 2011-03-05 21:30:33 UTC

*** This bug has been marked as a duplicate of bug 354080 ***