Vulnerability Details : CVE-2011-0762
Public exploit exists!
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
Vulnerability category: Denial of service
Products affected by CVE-2011-0762
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
- cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*
- cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-0762
25.27%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2011-0762
-
VSFTPD 2.3.2 Denial of Service
Disclosure Date: 2011-02-03First seen: 2023-09-11auxiliary/dos/ftp/vsftpd_232This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3. So far, it has been tested on 2.3.0, 2.3.1, and 2.3.2. Authors: - Nick Cottrell (Rad10Logic) <ncottrellweb@gmail.com> - Anna Graterol <annagraterol95@gmail.com> - Man
CVSS scores for CVE-2011-0762
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
8.0
|
2.9
|
NIST |
CWE ids for CVE-2011-0762
-
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-0762
-
http://www.vupen.com/english/advisories/2011/0547
Webmail | OVH- OVHThird Party Advisory
-
http://securityreason.com/achievement_securityalert/95
vsftpd 2.3.2 remote denial-of-service - CXSecurity.comExploit;Third Party Advisory
-
http://www.exploit-db.com/exploits/16270
vsftpd 2.3.2 - Denial of Service - Linux dos ExploitExploit;Third Party Advisory;VDB Entry
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622741
#622741 - vsftpd: upgrade stable to fix remote DoS (CVE-2011-0762) - Debian Bug report logsIssue Tracking;Third Party Advisory
-
http://cxib.net/stuff/vspoc232.c
All about me - Maksymilian Arciemowicz - cxib.netBroken Link
-
http://www.mandriva.com/security/advisories?name=MDVSA-2011:049
mandriva.comThird Party Advisory
-
http://www.redhat.com/support/errata/RHSA-2011-0337.html
SupportThird Party Advisory
-
http://www.ubuntu.com/usn/USN-1098-1
USN-1098-1: vsftpd vulnerability | Ubuntu security noticesThird Party Advisory
-
http://marc.info/?l=bugtraq&m=133226187115472&w=2
'[security bulletin] HPSBMU02752 SSRT100802 rev.1 HP Insight Control Software for Linux (IC-Linux), R' - MARCIssue Tracking;Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/65873
vsftpd vsf_filename_passes_filter denial of service CVE-2011-0762 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055881.html
[SECURITY] Fedora 13 Update: vsftpd-2.3.4-1.fc13Third Party Advisory
-
http://securityreason.com/securityalert/8109
vsftpd 2.3.2 remote denial-of-service - CXSecurity.comExploit;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2011:009Mailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/46617
vsftpd FTP Server 'ls.c' Remote Denial of Service VulnerabilityExploit;Third Party Advisory;VDB Entry
-
ftp://vsftpd.beasts.org/users/cevans/untar/vsftpd-2.3.4/Changelog
Broken Link
-
http://www.vupen.com/english/advisories/2011/0639
Webmail | OVH- OVHThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055882.html
[SECURITY] Fedora 14 Update: vsftpd-2.3.4-1.fc14Third Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055957.html
[SECURITY] Fedora 15 Update: vsftpd-2.3.4-1.fc15Third Party Advisory
-
http://jvn.jp/en/jp/JVN37417423/index.html
JVN#37417423: Multiple vulnerabilities in SolarView CompactThird Party Advisory
-
http://www.securityfocus.com/archive/1/516748/100/0/threaded
SecurityFocusThird Party Advisory;VDB Entry
-
http://www.vupen.com/english/advisories/2011/0668
Webmail | OVH- OVHThird Party Advisory
-
http://www.debian.org/security/2011/dsa-2305
Debian -- Security Information -- DSA-2305-1 vsftpdThird Party Advisory
-
http://www.kb.cert.org/vuls/id/590604
CERT Vulnerability Notes DatabaseBroken Link
-
http://www.securitytracker.com/id?1025186
vsftpd vsf_filename_passes_filter() Bug Lets Remote Authenticated Users Deny Service - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.vupen.com/english/advisories/2011/0713
Webmail | OVH- OVHThird Party Advisory
Jump to