Vulnerabilities > CVE-2017-15271 - Use After Free vulnerability in Psftp Psftpd 10.0.4

047910
CVSS 5.9 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
high complexity
psftp
CWE-416
exploit available
NVD
Published: 2017-11-15
Updated: 2024-11-21

Summary

A use-after-free issue could be triggered remotely in the SFTP component of PSFTPd 10.0.4 Build 729. This issue could be triggered prior to authentication. The PSFTPd server did not automatically restart, which enabled attackers to perform a very effective DoS attack against this service. By sending a crafted SSH identification / version string to the server, a NULL pointer dereference could be caused, apparently because of a race condition in the window message handling, performing the cleanup for invalid connections. This incorrect cleanup code has a use-after-free.

Vulnerable Configurations

Part Description Count
Application
Psftp
1

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionPSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free. CVE-2017-15270,CVE-2017-15271. Dos exploit for Windows platform
fileexploits/windows/dos/43144.txt
idEDB-ID:43144
last seen2017-11-14
modified2017-11-14
platformwindows
port
published2017-11-14
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/43144/
titlePSFTPd Windows FTP Server 10.0.4 Build 729 - Log Injection / Use-After-Free
typedos

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/144972/X41-2017-006.txt
idPACKETSTORM:144972
last seen2017-11-14
published2017-11-10
reporterMarkus Vervier
sourcehttps://packetstormsecurity.com/files/144972/PSFTPd-Windows-FTP-Server-10.0.4-Build-729-Use-After-Free-Log-Injection.html
titlePSFTPd Windows FTP Server 10.0.4 Build 729 Use-After-Free / Log Injection

References