CVE-2003-0831: ProFTPD ASCII mode newline handling buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution with a public exploit and very high EPSS score, though authentication is required and the affected versions are long obsolete.

What it is

ProFTPD 1.2.7 through 1.2.9rc2 fails to properly translate newline characters when transferring files in ASCII mode, resulting in a buffer overflow. A remote attacker can exploit this to execute arbitrary code on the FTP server. The flaw affects a core file-transfer path, so any deployment running an affected version with ASCII transfers enabled is exposed.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the ProFTPD process, typically full control of the FTP service and its host account. This can lead to data theft, file modification, or use of the server as a foothold for further attacks.

Attack surface

Reached over the network via the FTP service during an ASCII-mode file transfer; the CVSS vector (AV:N/AC:L/Au:S) indicates low complexity but that some authentication is required, so a valid or guest FTP account is likely needed. No user interaction beyond initiating the transfer is implied.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.58355, 99th percentile) and a public Exploit-DB entry (107) exists, indicating exploit code is available and exploitation is plausible.

What to do

• Upgrade ProFTPD to a version later than 1.2.9rc2 that contains the fix, or apply the vendor patch for the affected branch.
• If immediate upgrade is not possible, disable ASCII mode transfers or restrict them to trusted users.
• Restrict FTP access to trusted networks and enforce strong authentication; avoid anonymous or guest accounts.
• Monitor vendor and distribution advisories (e.g., Mandriva MDKSA-2003:095) for backported fixes on older platforms.
• Run the ProFTPD service with least privilege and isolate it from sensitive data.

Detection

• Inspect FTP server logs for ASCII-mode transfers (TYPE A) followed by crashes, restarts, or abnormal process termination.
• Monitor for unusually long or malformed file-transfer commands and newline-heavy payloads in FTP session logs.
• Watch for unexpected child processes or outbound connections spawned by the ProFTPD process.
• Use host-based detection for buffer overflow indicators such as segmentation faults in ProFTPD and core dumps.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.