CVE-2003-0854 Denial of service in n/a
Local users can cause memory exhaustion via large ls arguments, potentially leading to remote denial of service in applications like wu-ftpd.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2003-0854?
CVE-2003-0854 is a low-severity denial of service vulnerability in n/a, published on 25 Oct 2003. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ls in the fileutils or coreutils packages allows local users to consume a large amount of memory via a large -w value, which can be remotely exploited via applications that use ls, such as wu-ftpd.
Which versions are affected by CVE-2003-0854?
It affects 2 products.
Products include Gnu Fileutils, Washington University Wu-Ftpd.
How do I fix CVE-2003-0854?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2003-0854 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2003-0854 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2003-0854, GHSA-qjv8-gc24-r5w4.