CVE-2024-48208

What it actually does

Out-of-bounds read in the domlsd() function of ls.c allows an attacker to trigger a buffer overflow condition in the FTP server process.

Why it matters to the business

An attacker can cause the FTP server to crash or leak sensitive memory contents, leading to service disruption and potential exposure of internal data on systems running the vulnerable pure-ftpd version.

How an attack unfolds

An attacker connects to a vulnerable pure-ftpd instance and issues a specially crafted directory listing command that exercises the domlsd() function with malformed input, triggering the out-of-bounds read. Public weaponized exploits exist that automate this process to achieve denial of service or memory disclosure.

How to fix it

Upgrade pure-ftpd to version 1.0.52 or later (commit 15246910744807685fe00e1b301bd8e68123ed16). Apply vendor patches for any downstream packages. Restart the service after upgrade and verify the running version with pure-ftpd -V.

How to confirm the fix worked

Confirm the installed binary reports version 1.0.52 or newer. Perform a controlled test connection with directory listing commands while monitoring process stability and memory access logs. Re-scan affected hosts to ensure the vulnerable version is no longer present.

Typical attack path

1. Identify publicly reachable pure-ftpd servers via network scanning
2. Connect using an FTP client and authenticate if required
3. Send crafted LIST or LS command parameters that reach domlsd()
4. Trigger the out-of-bounds read to crash the process or read adjacent memory
5. Repeat or chain with other techniques for sustained impact

How to detect it

Review FTP server logs for unusual LIST command patterns or malformed directory requests. Correlate with process crash reports, segmentation fault entries in system logs, and any memory access violations around the ls.c code path. Check for repeated connection attempts from the same sources preceding service instability.

What your security team should do

• Immediately upgrade all pure-ftpd installations to the fixed commit or 1.0.52
• Restrict FTP access to trusted networks and enforce strong authentication
• Monitor for unexpected pure-ftpd process restarts or crashes
• Review and remove any unnecessary public FTP exposure