Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

ProFTPD SFTP module can crash server with bad SSH message

CVE-2011-1137 · published 15 years ago
Summary

The SFTP feature in ProFTPD versions up to 1.3.3d can be triggered by a specially crafted SSH message to consume all of the server’s memory, causing the service to stop responding. This could make your file‑transfer service unavailable to users. Upgrade ProFTPD to a newer release or turn off the SFTP module until you can apply the update.

What to do
  • Update debian proftpd-dfsg to version 1.3.3d-4.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian proftpd-dfsg < 1.3.3d-4
Fix: upgrade to 1.3.3d-4
Debian:13 debian proftpd-dfsg < 1.3.3d-4
Fix: upgrade to 1.3.3d-4
Debian:14 debian proftpd-dfsg < 1.3.3d-4
Fix: upgrade to 1.3.3d-4
– proftpd proftpd <= 1.3.3
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
4 more version ranges
cpe:2.3:a:proftpd:proftpd:*:d:*:*:*:*:*:*
Original advisory text
Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH me...
Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.
References
Severity
5.0 Medium
Exploitation
28% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published11 Mar 2011
Updated15 Oct 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2011-1137 · OSV
CVE-2011-1137 · NVD
Track software like this
Free during beta