CVE-2011-0762

Published: Mar 2, 2011Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

Affected (19)

Products: Vsftpd Project: Vsftpd · Canonical: Ubuntu Linux · Fedoraproject: Fedora · +3 more

Show all products

Vsftpd Project: Vsftpd · Canonical: Ubuntu Linux · Fedoraproject: Fedora · Debian: Debian Linux · Opensuse: Opensuse · Suse: Linux Enterprise Server

1 product

1 product

1 product

1 product

1 product

1 product

Linux Enterprise Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vsftpd Project Vsftpd	Before 2.3.3

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.10

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 13
Fedoraproject Fedora	Version 14
Fedoraproject Fedora	Version 15

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0

Configuration E

7 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.2
Opensuse Opensuse	Version 11.3
Opensuse Opensuse	Version 11.4
Suse Linux Enterprise Server	Version 10 sp3
Suse Linux Enterprise Server	Version 10 sp4
Suse Linux Enterprise Server	Version 11 sp1
Suse Linux Enterprise Server	Version 9

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (50)

ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-2.3.4/Changelog (unsafe URL)

Source: cret@cert.org

Broken Link

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622741

Source: cret@cert.org

Issue TrackingThird Party Advisory

http://cxib.net/stuff/vspoc232.c

Source: cret@cert.org

Broken Link

http://jvn.jp/en/jp/JVN37417423/index.html

Source: cret@cert.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055881.html

Source: cret@cert.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055882.html

Source: cret@cert.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055957.html

Source: cret@cert.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=133226187115472&w=2

Source: cret@cert.org

Issue TrackingThird Party Advisory

http://securityreason.com/achievement_securityalert/95

Source: cret@cert.org

ExploitThird Party Advisory

http://securityreason.com/securityalert/8109

Source: cret@cert.org

ExploitThird Party Advisory

http://www.debian.org/security/2011/dsa-2305

Source: cret@cert.org

Third Party Advisory

http://www.exploit-db.com/exploits/16270

Source: cret@cert.org

ExploitThird Party AdvisoryVDB Entry

http://www.kb.cert.org/vuls/id/590604

Source: cret@cert.org

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2011:049

Source: cret@cert.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2011-0337.html

Source: cret@cert.org

Third Party Advisory

http://www.securityfocus.com/archive/1/516748/100/0/threaded

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/46617

Source: cret@cert.org

ExploitThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1025186

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1098-1

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0547

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0639

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0668

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0713

Source: cret@cert.org

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/65873

Source: cret@cert.org

Third Party AdvisoryVDB Entry

ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-2.3.4/Changelog (unsafe URL)