ProFTPD Remote Buffer Overflow and Directory Traversal Vulnerabilities

Two vulnerabilities have been identified in ProFTPD, which could be exploited by remote attackers to take complete control of an affected system.

The first issue is caused by a stack overflow error in the "pr_netio_telnet_gets()" [src/netio.c] function when processing input containing a "TELNET_IAC" escape sequence, which could allow remote attackers to execute arbitrary code.

The second vulnerability is caused by errors in the "mod_site_misc" module when a writable directory exists, which could allow attackers with write permissions to create or delete a directory outside of the writable directory, create symlinks, or change the time of arbitrary files via a directory traversal.