CVE-2013-4359
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to...
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
- Record
CVE-2013-4359- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
- Record
CVE-2013-4359- Updated
- 2026-11-02
EUVDEUVD-2013-4243 No score
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
- Record
EUVD-2013-4243- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ccxh-j5wp-7pr6 No score
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to...
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
- Record
GHSA-ccxh-j5wp-7pr6- Updated
- 2026-11-02
OSV No score
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
- Record
CVE-2013-4359- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4359 No score
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
- Record
DEBIAN-CVE-2013-4359- Updated
- 2026-11-02
OSVMGASA-2013-0295 No score
Updated proftpd package fixes security vulnerability
A bug in ProFTPd's mod_sftp and mod_sftp_pam modules can be used to trigger a large heap allocation and exhaust all available system memory of the underlying operating system (CVE-2013-4359).
- Record
MGASA-2013-0295- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10048-1 No score
proftpd-1.3.5b-2.5 on GA media
These are all security issues fixed in the proftpd-1.3.5b-2.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10048-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4359 No score
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.
- Record
UBUNTU-CVE-2013-4359- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
proftpd-dfsgDebian:12 |
before 1.3.5~rc3-2.1 | 1.3.5~rc3-2.1 |
proftpd-dfsgDebian:13 |
before 1.3.5~rc3-2.1 | 1.3.5~rc3-2.1 |
proftpd-dfsgDebian:14 |
before 1.3.5~rc3-2.1 | 1.3.5~rc3-2.1 |
proftpd-dfsgDebian:6.0 |
before 1.3.3a-6squeeze7, plus listed versions 1.3.3a-61.3.3a-6squeeze11.3.3a-6squeeze41.3.3a-6squeeze51.3.3a-6squeeze6 |
1.3.3a-6squeeze7 |
proftpd-dfsgDebian:7 |
before 1.3.4a-5+deb7u1, plus listed versions 1.3.4a-4+nmu1 |
1.3.4a-5+deb7u1 |
proftpdMageia:2 |
before 1.3.3g-1.3.mga2 | 1.3.3g-1.3.mga2 |
proftpdMageia:3 |
before 1.3.4c-2.1.mga3 | 1.3.4c-2.1.mga3 |
proftpdopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 1.3.5b-2.5 | 1.3.5b-2.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4359 is a medium vulnerability (CVSS 5.0) in Proftpd, published September 28, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in proftpd-dfsg 1.3.5~rc3-2.1.
References
kingcope.wordpress.com/2013/09/11/proftpd-mod_sftpmod_sftp_pam-invalid-pool-allocation-in-kbdint-authentication
openwall.com/lists/oss-security/2013/09/17/6
debian.org/security/2013/dsa-2767
lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
bugs.proftpd.org/show_bug.cgi?id=3973
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4359
github.com/advisories/GHSA-ccxh-j5wp-7pr6
security-tracker.debian.org/tracker/CVE-2013-4359
advisories.mageia.org/MGASA-2013-0295.html
bugs.mageia.org/show_bug.cgi?id=11282
lists.fedoraproject.org/pipermail/package-announce/2013-September/116668.html
ubuntu.com/security/CVE-2013-4359
cve.org/CVERecord?id=CVE-2013-4359
suse.com/security/cve/CVE-2009-0542