CVE-2010-4221 Memory corruption in n/a

What is CVE-2010-4221?

CVE-2010-4221 is a critical memory corruption vulnerability in n/a, published on 9 Nov 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.

Weakness: CWE-119

Which versions are affected by CVE-2010-4221?

It affects 1 product.

Products include Proftpd Proftpd.

How do I fix CVE-2010-4221?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2010-4221 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-4221 exists.

Public exploit code: 2 Metasploit modules, 3 Exploit-DB entries and 3 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2010-20103 ProFTPD 1.3.3c Backdoor Command Execution Critical 9.3
• CVE-2011-4130 Use after free in n/a Critical 9.0
• CVE-2026-63090 ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly High 8.7
• CVE-2026-35025 ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR High 8.6
• CVE-2026-42167 SQL injection in ProFTPD High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2010-4221, GHSA-gf2w-q84f-pmmw.