CVE-2011-0762 The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob exp...
MediumCVSS 4.0
EPSS 73.9%
Framework module
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vsftpd project vsftpd | < 2.3.3 | 2.3.3 |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 9.10 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| fedoraproject fedora | = 13 | No fix listed |
| fedoraproject fedora | = 14 | No fix listed |
| fedoraproject fedora | = 15 | No fix listed |
| debian linux | = 5.0 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| opensuse | = 11.2 | No fix listed |
| opensuse | = 11.3 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| SUSE linux enterprise server | = 9 | No fix listed |
| SUSE linux enterprise server | = 10-sp3 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| debian/vsftpd(Debian:12) | < 2.3.4-1 | 2.3.4-1 |
| debian/vsftpd(Debian:13) | < 2.3.4-1 | 2.3.4-1 |
| debian/vsftpd(Debian:14) | < 2.3.4-1 | 2.3.4-1 |
References
- Debian Security Tracker CVE-2011-0762 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking third-party-advisory
- cxib.net broken-link
- JVN#37417423 third-party-advisory
- FEDORA-2011-2615 third-party-advisory vendor-advisory
- FEDORA-2011-2590 third-party-advisory vendor-advisory
- FEDORA-2011-2567 third-party-advisory vendor-advisory
- SUSE-SR:2011:009 mailing-list third-party-advisory vendor-advisory
- HPSBMU02752 issue-tracking third-party-advisory vendor-advisory
- 20110301 vsftpd 2.3.2 remote denial-of-service exploit third-party-advisory
- 8109 exploit third-party-advisory
- DSA-2305 third-party-advisory vendor-advisory
- 16270 exploit third-party-advisory vdb-entry
- VU#590604 broken-link third-party-advisory
- MDVSA-2011:049 third-party-advisory vendor-advisory
- RHSA-2011:0337 third-party-advisory vendor-advisory
- 20110301 vsftpd 2.3.2 remote denial-of-service mailing-list third-party-advisory vdb-entry
- 46617 exploit third-party-advisory vdb-entry
- 1025186 third-party-advisory vdb-entry
- USN-1098-1 third-party-advisory vendor-advisory
- ADV-2011-0547 third-party-advisory vdb-entry
- ADV-2011-0639 third-party-advisory vdb-entry
- ADV-2011-0668 third-party-advisory vdb-entry
- ADV-2011-0713 third-party-advisory vdb-entry
- vsftpd-vsffilenamepassesfilter-dos(65873) third-party-advisory vdb-entry