Heap-based Buffer Overflow in ProFTPD with SQL Module

CVE-2010-4652

What is CVE-2010-4652?

A heap-based buffer overflow exists in the sql_prepare_where function of ProFTPD when the mod_sql module is enabled, prior to version 1.3.3d. This vulnerability can be exploited by remote attackers who craft specific usernames containing substitution tags. Improper handling of these tags during SQL query construction leads not only to potential service crashes but also to the possibility of executing arbitrary code, posing serious risks to the integrity and availability of affected systems.

References