Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 1.3.9c 和 1.3.10rc3 之前的 ProFTPD 在 mod_sftp 模組的 SCP 大小記錄剖析器中包含一個帶正負號的整數溢位弱點，該弱點允許經過驗證的低權限攻擊者透過傳送特製的檔案大小值 UINT64_MAX 來繞過 ASLR，這會導致負off_t值。攻擊者可利用後續轉換為 uint32_t，造成大約 4 GB 的請求讀取長度，並迫使伺服器讀取超出 SSH 通道資料的結尾，並將過度讀取處理程序記憶體寫入上傳的檔案中。在測試的配置中，披露的數據包含足以衍生其隨機基地址的 libc、libcrypto 和 PIE 指標，從而繞過 ASLR 並能夠在同一過程中可靠地利用記憶體損毀漏洞。（CVE-2026-63091）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 低于 1.3.9c 和 1.3.10rc3 的 ProFTPD 在 mod_sftp 模块的 SCP 大小记录解析器中包含有符号的整数溢出漏洞，允许经认证的低权限攻击者通过发送构建的文件大小值 UINT64_MAX 绕过 ASLR，从而导致负的off_t值。攻击者可利用后续转换为 uint32_t，造成大约 4 GB 的请求读取长度，并强制服务器读取超过 SSH 通道数据结尾，并将过度读取的进程内存写入已上传的文件中。在测试的配置中，泄露的数据包含的 libc、libcrypto 和 PIE 指针足以派生其随机基址，从而绕过 ASLR，并能够在同一进程中可靠利用内存损坏漏洞。（CVE-2026-63091）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 1.3.9c および 1.3.10rc3 より前の ProFTPD には、mod_sftp モジュールの SCP サイズレコードパーサーに署名済み整数オーバーフロー脆弱性が含まれており、認証された権限の低い攻撃者が、細工されたファイルサイズ値 UINT64_MAX を送信することで ASLR をバイパスし、負のoff_t値になる可能性があります。攻撃者がその後のuint32_tへの変換を悪用して、約 4 GB のリクエストされた読み取り長を引き起こし、サーバーに強制的に SSH チャネルデータの終端を超えて読み取り、アップロードされたファイルにオーバーリードプロセスメモリを書き込む可能性があります。テスト済みの構成では、漏えいされたデータに、ランダム化されたベースアドレスを導出するのに十分な libc、libcrypto、PIE ポインターが含まれているため、ASLR をバイパスし、同じプロセス内のメモリ破損の脆弱性を確実に悪用することが可能です。(CVE-2026-63091)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process.(CVE-2026-63091)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp     module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending     crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can     supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist     metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect     pr_fsio_stat() to system() via a crafted RENAME request.(CVE-2026-63090)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process. (CVE-2026-63091)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp     module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending     crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can     supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist     metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect     pr_fsio_stat() to system() via a crafted RENAME request.(CVE-2026-63090)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process.(CVE-2026-63091)

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
328232	Linux Distros 未修補弱點：CVE-2026-63091	Nessus	Misc.	2026/7/20	2026/9/14	high
328232	Linux Distros 未修补的漏洞：CVE-2026-63091	Nessus	Misc.	2026/7/20	2026/9/14	high
328232	Linux Distros のパッチ未適用の脆弱性: CVE-2026-63091	Nessus	Misc.	2026/7/20	2026/9/14	high
364976	EulerOS 2.0 SP13 : proftpd (EulerOS-SA-2026-4183)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	high
328232	Linux Distros Unpatched Vulnerability : CVE-2026-63091	Nessus	Misc.	2026/7/20	2026/9/14	high
364775	EulerOS 2.0 SP13 : proftpd (EulerOS-SA-2026-4092)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	high
365084	EulerOS 2.0 SP11 : proftpd (EulerOS-SA-2026-4275)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	high
364924	EulerOS 2.0 SP11 : proftpd (EulerOS-SA-2026-4365)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high