CVE-2024-57392: 
Linux Debian vulnerability analysis and mitigation

A Buffer Overflow vulnerability was discovered in ProFTPD (CVE-2024-57392) that affects commit 4017eff8. The vulnerability was disclosed on February 6, 2025, and allows remote attackers to execute arbitrary code and cause a Denial of Service (DoS) on the FTP service through maliciously crafted messages sent to the ProFTPD service port (NVD).

The vulnerability is classified as a classic Buffer Overflow (CWE-120) that occurs when processing certain messages on the FTP service port. The CVSS v3.1 base score is 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (NVD).

The vulnerability can result in arbitrary code execution and Denial of Service conditions on affected ProFTPD servers. When successfully exploited, the attack can completely disrupt the availability of the FTP service (Debian LTS).

For Debian 11 (Bullseye) users, the vulnerability has been patched in version 1.3.7a+dfsg-12+deb11u5. System administrators are strongly recommended to upgrade their ProFTPD packages to the latest version (Debian LTS).