Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - ProFTPD mod_sftp包含經驗證的 SFTP 使用者可連線的堆積型緩衝區溢位。fxp_packet_read（） 函式接受攻擊者提供的 32 位元大端 SFTP 封包長度，而無需進行最低可用性檢查。值為 0 會導致讀取路徑中其他位置的未帶正負號減法反向溢位至大約 4 GB。該過大的請求到達核心記憶體分配器，其中四捨五入的大小以 size_t 計算，但以 32 位元 int 的形式傳遞給 new_block（）;0x100000000的低 32 位元為 0，因此 new_block（） 傳回一個小 （~512 位元組） 區塊，同時呼叫者被告知它收到了 ~4 GB。接著，後續的填充迴圈會將攻擊者控制的位元組串流到 544 位元組配置的結尾，從而產生攻擊者控制的堆積緩衝區溢位。經驗證的使用者可以使用單一格式錯誤的 SFTP 封包 （packet_len=0 後面接著大於大約 544 位元組的內文） 視需要使每個連線的 ProFTPD 工作階段子項當機，從而產生可靠的已驗證遠端拒絕服務。視堆積配置和相鄰配置而定，可能會發生堆積中繼資料損毀，以及拒絕服務以外的進一步後果，不過提供的概念證明只會證明拒絕服務。
    (CVE-2026-53994)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - ProFTPD mod_sftp包含基于堆的缓冲区溢出，经认证的 SFTP 用户可访问该溢出。fxp_packet_read（） 函数接受攻击者提供的 32 位 big-endian SFTP 数据包长度，而无需进行最低健全性检查。值为 0 会导致读取路径中其他位置的无符号减法下溢至大约 4 GB。该超大请求到达核心内存分配器，该分配器以 size_t 计算舍入大小，但以 32 位 int 的形式传递给 new_block（）;0x100000000的低 32 位为 0，因此当调用程序被告知其收到 ~4 GB 时，new_block（） 会返回一个小（~512 字节）区块。随后的填充循环会将攻击者控制的字节流式传输到 544 字节分配的末尾之后，进而产生攻击者控制的堆缓冲区溢出。经认证的用户可根据需要使用单个畸形 SFTP 数据包（packet_len=0，后跟大于约 544 字节的正文）使每个连接的 ProFTPD 会话子进程崩溃，从而产生可靠的经认证的远程拒绝服务。根据堆布局和相邻分配，虽然提供的概念证明仅证实拒绝服务，但可能会造成堆元数据损坏和拒绝服务以外的其他后果。
    (CVE-2026-53994)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - ProFTPD mod_sftpには、認証された SFTP ユーザーが到達可能なヒープベースのバッファオーバーフローがあります。fxp_packet_read() 関数は、攻撃者指定の 32 ビットビッグエンディアン SFTP パケット長を、最小限のサニティチェックなしで受け入れます。値が0であると、読み取りパスの他の場所で符号なし減算が約4GBまでアンダーフローします。そのオーバーサイズのリクエストはコアメモリアロケーターに到達し、丸められたサイズはsize_tで計算されますが、32ビットintとしてnew_block()に渡されます。0x100000000の下位32ビットは0であるため、呼び出し元に~4GBを受信したと通知されている間、new_block()は小さな(~512バイト)ブロックを返します。その後のフィルループは、攻撃者が制御するバイトを 544 バイトの割り当ての終端を超えてストリーミングし、攻撃者が制御するヒープバッファオーバーフローを発生させます。認証されたユーザーが、単一の無効な形式の SFTP パケット(packet_len=0 に続けて約 544 バイトを超える本文が続く)により、接続ごとの ProFTPD セッションの子をオンデマンドでクラッシュさせ、信頼できる認証されたリモートのサービス拒否を発生させる可能性があります。ヒープレイアウトと隣接する割り当てによっては、提供された概念実証によってはサービス拒否のみが実証されますが、ヒープメタデータの破損およびサービス拒否を超えたさらなる影響が発生する可能性があります。
    (CVE-2026-53994)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process.(CVE-2026-63091)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp     module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending     crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can     supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist     metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect     pr_fsio_stat() to system() via a crafted RENAME request.(CVE-2026-63090)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp     module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending     crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can     supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist     metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect     pr_fsio_stat() to system() via a crafted RENAME request.(CVE-2026-63090)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process.(CVE-2026-63091)

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

    In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in     contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain     name that is accessed in a reverse DNS lookup. When 'UseReverseDNS on' is enabled, the attacker-supplied     hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect     exploitability.(CVE-2026-44331)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of concept.
    (CVE-2026-53994)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5181-1 advisory.

    - Authenticated SFTP sessions can overflow the SFTP packet buffer (bsc#1271096).
    - CVE-2026-35025: access control bypass allows authenticated FTP users to circumvent Directory ACL     restrictions by       prefixing paths with `/proc/self/root` in the RNFR command handler (bsc#1269065).
    - CVE-2026-42167: `mod_sql` allows remote attackers to execute arbitrary code via a username when there is     logging of       `USER` requests with an expansion such as `%U` and the SQL backend allows `comman` (bsc#1263183).
    - CVE-2026-44331: SQL injection in `sqltab_fetch_clients_cb()` in `contrib/mod_wrap2_sql.c` triggered via     crafted domain       name from reverse DNS lookup (bsc#1264262).
    - CVE-2026-53994: heap-based buffer overflow reachable by an authenticated SFTP user can lead to denial of     service and       memory corruption (bsc#1271946).
    - CVE-2026-63090: heap-based buffer overflow in the `mod_sftp` module can lead to arbitrary code execution     via crafted       SFTP packet fragments (bsc#1271944).
    - CVE-2026-63091: signed integer overflow in the `mod_sftp` module's SCP size-record parser can lead to     ASLR bypass via       a crafted file size value of `UINT64_MAX` (bsc#1271945).
    - CVE-2026-119147: authorization bypass in the `mod_sftp` copy-file extension handler allows SFTP users to     copy any       readable file to a new path in write-denied directories (bsc#1289272).
    - Integer overflow via client-provided file size for SCP uploads (bsc#1271097).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
327905	Linux Distros 未修補弱點：CVE-2026-53994	Nessus	Misc.	2026/7/20	2026/9/14	high
327905	Linux Distros 未修补的漏洞：CVE-2026-53994	Nessus	Misc.	2026/7/20	2026/9/14	high
327905	Linux Distros のパッチ未適用の脆弱性: CVE-2026-53994	Nessus	Misc.	2026/7/20	2026/9/14	high
364775	EulerOS 2.0 SP13 : proftpd (EulerOS-SA-2026-4092)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	high
365084	EulerOS 2.0 SP11 : proftpd (EulerOS-SA-2026-4275)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	high
347138	EulerOS 2.0 SP10 : proftpd (EulerOS-SA-2026-3713)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	high
347241	EulerOS 2.0 SP10 : proftpd (EulerOS-SA-2026-3760)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	high
364924	EulerOS 2.0 SP11 : proftpd (EulerOS-SA-2026-4365)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	high
343634	EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-3373)	Nessus	Huawei Local Security Checks	2026/9/8	2026/9/8	high
364069	EulerOS 2.0 SP15 : proftpd (EulerOS-SA-2026-3941)	Nessus	Huawei Local Security Checks	2026/10/8	2026/10/8	high
343619	EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-3298)	Nessus	Huawei Local Security Checks	2026/9/8	2026/9/8	high
364009	EulerOS 2.0 SP15 : proftpd (EulerOS-SA-2026-4007)	Nessus	Huawei Local Security Checks	2026/10/8	2026/10/8	high
364976	EulerOS 2.0 SP13 : proftpd (EulerOS-SA-2026-4183)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	high
327905	Linux Distros Unpatched Vulnerability : CVE-2026-53994	Nessus	Misc.	2026/7/20	2026/9/14	high
379477	SUSE SLES15: proftpd / proftpd-devel / proftpd-doc / proftpd-lang / proftpd-ldap / etc (SUSE-SU-2026:5181-1)	Nessus	SuSE Local Security Checks	2026/11/12	2026/11/13	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high