CVE-2024-57392
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute...
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
- Record
CVE-2024-57392- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-04
EUVDEUVD-2024-53576
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
- Record
EUVD-2024-53576- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-cf42-x7h8-3v3q
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute...
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
- Record
GHSA-cf42-x7h8-3v3q- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
- Record
CVE-2024-57392- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-57392
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
- Record
DEBIAN-CVE-2024-57392- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2022
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif
Security Fix(es):
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.(CVE-2024-57392)
- Record
OESA-2025-2022- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2025-2023
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif
Security Fix(es):
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.(CVE-2024-57392)
- Record
OESA-2025-2023- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2024
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif
Security Fix(es):
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.(CVE-2024-57392)
- Record
OESA-2025-2024- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2025
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif
Security Fix(es):
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.(CVE-2024-57392)
- Record
OESA-2025-2025- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2026
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif
Security Fix(es):
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.(CVE-2024-57392)
- Record
OESA-2025-2026- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2083
proftpd security update
ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. %if 1 This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included. %else This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by xinetd instead are included. %endif
Security Fix(es):
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.(CVE-2024-57392)
- Record
OESA-2025-2083- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-57392
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
- Record
UBUNTU-CVE-2024-57392- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port.
- Record
CVE-2024-57392- Updated
- 2026-11-02
OSVMGASA-2025-0081 No score
Updated proftpd packages fix security vulnerability
A buffer overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a denial of service (DoS) on the FTP service by sending a maliciously crafted message to the ProFTPD service port. (CVE-2024-57392)
- Record
MGASA-2025-0081- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14827-1 No score
proftpd-1.3.8c-2.1 on GA media
These are all security issues fixed in the proftpd-1.3.8c-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14827-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:1028-1 No score
Security update for proftpd
This update for proftpd fixes the following issues:
- CVE-2024-57392: Fixed null pointer dereference vulnerability by sending a maliciously crafted message (bsc#1238143).
- CVE-2024-48651: Fixed supplemental group inheritance granting unintended access to GID 0 (bsc#1238141).
- Record
SUSE-SU-2025:1028-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
proftpd-dfsgDebian:12 |
before 1.3.8+dfsg-4+deb12u5, plus listed versions 1.3.8+dfsg-41.3.8+dfsg-4+deb12u11.3.8+dfsg-4+deb12u21.3.8+dfsg-4+deb12u31.3.8+dfsg-4+deb12u4 |
1.3.8+dfsg-4+deb12u5 |
proftpd-dfsgDebian:13 |
before 1.3.8.c+dfsg-2 | 1.3.8.c+dfsg-2 |
proftpd-dfsgDebian:14 |
before 1.3.8.c+dfsg-2 | 1.3.8.c+dfsg-2 |
proftpd-dfsgDebian:11 |
before 1.3.7a+dfsg-12+deb11u5, plus listed versions 1.3.7a+dfsg-121.3.7a+dfsg-12+deb11u11.3.7a+dfsg-12+deb11u21.3.7a+dfsg-12+deb11u3 |
1.3.7a+dfsg-12+deb11u5 |
proftpdMageia:9 |
before 1.3.8c-1.1.mga9 | 1.3.8c-1.1.mga9 |
proftpdopenEuler:22.03-LTS-SP4 |
before 1.3.8b-6.oe2203sp4 | 1.3.8b-6.oe2203sp4 |
proftpdopenEuler:24.03-LTS |
before 1.3.8b-7.oe2403 | 1.3.8b-7.oe2403 |
proftpdopenEuler:24.03-LTS-SP1 |
before 1.3.8b-7.oe2403sp1 | 1.3.8b-7.oe2403sp1 |
proftpdopenEuler:24.03-LTS-SP2 |
before 1.3.8b-7.oe2403sp2 | 1.3.8b-7.oe2403sp2 |
proftpdopenEuler:22.03-LTS-SP3 |
before 1.3.8b-6.oe2203sp3 | 1.3.8b-6.oe2203sp3 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
proftpdopenEuler:20.03-LTS-SP4 |
before 1.3.8b-4.oe2003sp4 | 1.3.8b-4.oe2003sp4 |
proftpdSUSE:Linux Enterprise Module for Server Applications 15 SP6 From an advisory covering 2 CVEs |
before 1.3.8b-150600.13.6.1 | 1.3.8b-150600.13.6.1 |
proftpdopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 1.3.8b-150600.13.6.1 | 1.3.8b-150600.13.6.1 |
proftpd-dfsgUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.5-21.3.5a-11.3.5a-1build11.3.5a-1ubuntu0.1 |
None known |
proftpd-dfsgUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.5d-11.3.5e-1build1 |
None known |
proftpd-dfsgUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.6-6build21.3.6c-11.3.6c-21.3.6c-2ubuntu0.1 |
None known |
proftpd-dfsgUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.7b+dfsg-11.3.7c+dfsg-1build11.3.7c+dfsg-1ubuntu0.1 |
None known |
proftpd-dfsgUbuntu:24.04:LTS |
All versions, plus listed versions 1.3.8+dfsg-81.3.8.a+dfsg-11.3.8.b+dfsg-11.3.8.b+dfsg-1build11.3.8.b+dfsg-1build21.3.8.b+dfsg-1build31.3.8.b+dfsg-1ubuntu0.1 |
None known |
proftpd-dfsgUbuntu:25.10 |
All versions, plus listed versions 1.3.8.c+dfsg-21.3.8.c+dfsg-41.3.9~dfsg-3 |
None known |
proftpd-dfsgUbuntu:26.10 |
All versions, plus listed versions 1.3.9~dfsg-41.3.9b~dfsg-11.3.9d~dfsg-1 |
None known |
proftpd-dfsgUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.9~dfsg-31.3.9~dfsg-4 |
None known |
proftpdopenSUSE:Tumbleweed |
before 1.3.8c-2.1 | 1.3.8c-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | CVE List, EUVD | |
| facts | CVE List, EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-57392 is a high vulnerability (CVSS 7.5) in proftpd, published February 6, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in proftpd-dfsg 1.3.8+dfsg-4+deb12u5.
References
github.com/Br1m4zz/protocol_vul_repoduce.git
lists.debian.org/debian-lts-announce/2025/03/msg00003.html
nvd.nist.gov/vuln/detail/CVE-2024-57392
security-tracker.debian.org/tracker/CVE-2024-57392
advisories.mageia.org/MGASA-2025-0081.html
Show 17 moreShow less
bugs.mageia.org/show_bug.cgi?id=34042
lists.fedoraproject.org/archives/list/[email protected]/message/E36XSNXDCOSSYTPKEMAEUAZ6QVQJTSFZ
lists.opensuse.org/archives/list/[email protected]/message/C3HZA5IS6YXHXDULEZHLHWOVCC3IYNGP
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2022
suse.com/support/update/announcement/2025/suse-su-20251028-1
bugzilla.suse.com/1238141
ubuntu.com/security/CVE-2024-57392
cve.org/CVERecord?id=CVE-2024-57392