CVE-2010-4652

Published Feb 2, 2011 CVSS 2.0 · 6.8 Medium EPSS 11.2% KEV · Not listed
Description
Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-2191-1 proftpd security update
EUVD EUVD EUVD-2010-4617 Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 7, 2024, 3:51 AM
Reserved
Jan 3, 2011, 12:00 AM
Status
Modified
Published
Feb 2, 2011, 1:00 AM
Modified
Jun 16, 2026, 11:25 PM