CVE-2011-0762 Denial of service in n/a

Medium 4.0 Published 2 Mar 2011 Updated 6 Aug 2024

Authenticated remote attackers can cause denial of service in vsftpd via crafted glob expressions in STAT commands, leading to CPU exhaustion.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-0762?

CVE-2011-0762 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 2 Mar 2011. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

Weakness: CWE-400

Which versions are affected by CVE-2011-0762?

It affects 6 products.

Linux distribution packages (10)

`vsftpd` Red Hat:enterprise_linux:4::as	All versions	`0:2.0.1-9.el4`
`vsftpd-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:2.0.1-9.el4`
`vsftpd` Red Hat:enterprise_linux:4::es	All versions	`0:2.0.1-9.el4`
`vsftpd-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:2.0.1-9.el4`
`vsftpd` Red Hat:enterprise_linux:5::server	All versions	`0:2.0.5-16.el5_6.1`
`vsftpd-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:2.0.5-16.el5_6.1`
`vsftpd` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.2-6.el6_0.1`
`vsftpd-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:2.2.2-6.el6_0.1`
`vsftpd` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.2-6.el6_0.1`
`vsftpd-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:2.2.2-6.el6_0.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Opensuse, Suse Linux Enterprise Server, Vsftpd Project Vsftpd.

How do I fix CVE-2011-0762?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2011-0762 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-0762 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2011-0762, DSA-2305-1, GHSA-jh3r-4mfv-pjv8, RHSA-2011:0337.