CVE-2010-4652: Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d,...

Security readout for executives and security teams

This flaw affects ProFTPD FTP servers before 1.3.3d when the SQL module is enabled. A remote user-supplied username can crash the service and may allow arbitrary code execution. Business urgency depends on whether legacy ProFTPD with mod_sql is still exposed. Likely exposure is legacy ProFTPD deployments earlier than 1.3.3d with mod_sql enabled, especially internet-facing FTP services or systems relying on SQL-backed authentication. Systems without mod_sql enabled are not described as affected in the provided sources. Prioritize remediation for any exposed legacy ProFTPD service using mod_sql. The possible code execution impact is serious, but scope is constrained by version and module configuration. Mitigation focus: Upgrade ProFTPD to 1.3.3d or later, or a vendor-fixed package.; Disable mod_sql if SQL-backed FTP authentication is not required.; Restrict FTP access to trusted networks until remediation is complete..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.