Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

ProFTPD can crash or be hijacked by long password

CVE-2005-4816 · published 20 years ago
Summary

The ProFTPD file‑transfer server’s radius authentication module can mishandle an unusually long password, causing the service to stop working and, in some cases, letting an attacker run their own code. This means your file server could become unavailable or be compromised. Update ProFTPD to the latest version or apply the provided patch to fix the problem.

What to do
  • Update debian proftpd-dfsg to version 1.2.10+1.3.0rc5-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian proftpd-dfsg < 1.2.10+1.3.0rc5-1
Fix: upgrade to 1.2.10+1.3.0rc5-1
Debian:13 debian proftpd-dfsg < 1.2.10+1.3.0rc5-1
Fix: upgrade to 1.2.10+1.3.0rc5-1
Debian:14 debian proftpd-dfsg < 1.2.10+1.3.0rc5-1
Fix: upgrade to 1.2.10+1.3.0rc5-1
– proftpd_project proftpd 1.2
1.2.0_rc1
1.2.0_rc2
1.2.0_rc3
1.2.1
1.2.2
1.2.2_rc1
1.2.2_rc3
1.2.3
1.2.4
1.2.5
1.2.5_rc1
25 more version ranges
cpe:2.3:a:proftpd_project:proftpd:1.2:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.
Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password.
References
Severity
7.5 High
Exploitation
13% chance of attack within 30 days
Timeline
Published31 Dec 2005
Updated22 Oct 2026
First seen8 Sep 2026
Sources
DEBIAN-CVE-2005-4816 · OSV
CVE-2005-4816 · NVD
Track software like this
Free during beta