Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 357535 - net-ftp/proftpd: integer overflow in mod_sftp (CVE-2011-1137)
Summary: net-ftp/proftpd: integer overflow in mod_sftp (CVE-2011-1137)
Status: RESOLVED DUPLICATE of bug 354080
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
Whiteboard: B3? [upstream/ebuild?]
Depends on:
Reported: 2011-03-05 15:03 UTC by Paweł Hajdan, Jr. (RETIRED)
Modified: 2011-03-05 21:30 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-03-05 15:03:21 UTC
An integer overflow flaw was reported [1],[2] in the mod_sftp module of
ProFTPD.  If a specially crafted SSH message was sent to a ProFTPD server using
mod_sftp, it could lead to the allocation of enormous amounts of memory and an
eventual OOM termination by the kernel.  This issue was assigned the name
CVE-2011-1137 [3].  It was fixed in CVS [4],[5],[6]


Comment 1 Tim Sammut (RETIRED) gentoo-dev 2011-03-05 21:30:33 UTC

*** This bug has been marked as a duplicate of bug 354080 ***