The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

Certain file patterns could cause vsftpd to consume excessive CPU resulting in denial of service (CVE-2011-0762).

From Red Hat Security Advisory 2011:0337 :

An updated vsftpd package that fixes one security issue is now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

vsftpd (Very Secure File Transfer Protocol (FTP) daemon) is a secure FTP server for Linux, UNIX, and similar operating systems.

A flaw was discovered in the way vsftpd processed file name patterns.
An FTP user could use this flaw to cause the vsftpd process to use an excessive amount of CPU time, when processing a request with a specially crafted file name pattern. (CVE-2011-0762)

All vsftpd users should upgrade to this updated package, which contains a backported patch to correct this issue. The vsftpd daemon must be restarted for this update to take effect.

A flaw was discovered in the way vsftpd processed file name patterns.
An FTP user could use this flaw to cause the vsftpd process to use an excessive amount of CPU time, when processing a request with a specially crafted file name pattern. (CVE-2011-0762)

The vsftpd daemon must be restarted for this update to take effect.

Certain file patterns could cause vsftpd to consume excessive CPU resulting in denial of service (CVE-2011-0762). This has been fixed.

The remote host is affected by the vulnerability described in GLSA-201110-07 (vsftpd: Denial of Service)

    A Denial of Service vulnerability was discovered in vsftpd. Please       review the CVE identifier referenced below for details.
  Impact :

    A remote authenticated attacker could cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Two security issue have been discovered that affect vsftpd, a lightweight, efficient FTP server written for security.

  - CVE-2011-2189     It was discovered that Linux kernels < 2.6.35 are     considerably slower in releasing than in the creation of     network namespaces. As a result of this and because     vsftpd is using this feature as a security enhancement     to provide network isolation for connections, it is     possible to cause denial of service conditions due to     excessive memory allocations by the kernel. This is     technically no vsftpd flaw, but a kernel issue. However,     this feature has legitimate use cases and backporting     the specific kernel patch is too intrusive.
    Additionally, a local attacker requires the     CAP_SYS_ADMIN capability to abuse this functionality.
    Therefore, as a fix, a kernel version check has been     added to vsftpd in order to disable this feature for     kernels < 2.6.35.

  - CVE-2011-0762     Maksymilian Arciemowicz discovered that vsftpd is     incorrectly handling certain glob expressions in STAT     commands. This allows a remote authenticated attacker to     conduct denial of service attacks (excessive CPU and     process slot exhaustion) via crafted STAT commands.

It was discovered that vsftpd incorrectly handled certain glob expressions. A remote authenticated user could use a crafted glob expression to cause vftpd to consume all resources, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered and corrected in vsftpd :

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632 (CVE-2011-0762).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

According to its self-reported version number, the instance of vsftpd listening on the remote server is earlier than 2.3.3 and, as such, may be affected by a denial of service vulnerability.

An error exists in the function 'vsf_filename_passes_filter()' in 'ls.c' that allows resource intensive glob expressions to be processed with the 'STAT' command. Using numerous IP addresses to bypass an FTP-sessions-per-IP-address limit, a remote attacker can carry out a denial of service attack.

Note that Nessus did not actually test for the flaw but instead has relied on the version in vsftpd's banner.

- Bug #681667 - CVE-2011-0762 vsftpd: remote DoS via     crafted glob pattern

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Mar 3 2011 Jiri Skala <jskala at redhat.com> -     2.3.4-1

    - update to latest upstream 2.3.4

    - fixes #681935 - CVE-2011-0762 vsftpd: remote DoS via       crafted glob pattern

    - Mon May 17 2010 Jiri Skala <jskala at redhat.com> -       2.2.2-7

    - when listen_ipv6=YES sets socket option to listen IPv6       only

    - Fri May 14 2010 Jiri Skala <jskala at redhat.com> -       2.2.2-6

    - syscall(__NR_clone) replaced by clone() to fix       incorrect order of params on s390 arch

    - Wed Apr 7 2010 Jiri Skala <jskala at redhat.com> -       2.2.2-5

    - corrected daemonize_plus patch - don't try kill parent       when vsftpd isn't daemonized

    - Tue Mar 16 2010 Jiri Skala <jskala at redhat.com> -       2.2.2-4

    - fixes #544251 - /etc/rc.d/init.d/vsftpd does not start       more than one daemon

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Mar 3 2011 Jiri Skala <jskala at redhat.com> -     2.3.4-1

    - update to latest upstream 2.3.4

    - fixes #681935 - CVE-2011-0762 vsftpd: remote DoS via       crafted glob pattern

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated vsftpd package that fixes one security issue is now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

vsftpd (Very Secure File Transfer Protocol (FTP) daemon) is a secure FTP server for Linux, UNIX, and similar operating systems.

A flaw was discovered in the way vsftpd processed file name patterns.
An FTP user could use this flaw to cause the vsftpd process to use an excessive amount of CPU time, when processing a request with a specially crafted file name pattern. (CVE-2011-0762)

All vsftpd users should upgrade to this updated package, which contains a backported patch to correct this issue. The vsftpd daemon must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 4 / 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:0337 advisory.

  - vsftpd: remote DoS via crafted glob pattern (CVE-2011-0762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
76042	openSUSE Security Update : vsftpd (openSUSE-SU-2011:0435-1)	Nessus	SuSE Local Security Checks	medium
75769	openSUSE Security Update : vsftpd (openSUSE-SU-2011:0435-1)	Nessus	SuSE Local Security Checks	medium
68226	Oracle Linux 4 / 5 / 6 : vsftpd (ELSA-2011-0337)	Nessus	Oracle Linux Local Security Checks	medium
60986	Scientific Linux Security Update : vsftpd on SL4.x, SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57260	SuSE 10 Security Update : vsftpd (ZYPP Patch Number 7408)	Nessus	SuSE Local Security Checks	medium
56460	GLSA-201110-07 : vsftpd: Denial of Service	Nessus	Gentoo Local Security Checks	medium
56231	Debian DSA-2305-1 : vsftpd - denial of service	Nessus	Debian Local Security Checks	high
53828	SuSE 10 Security Update : vsftpd (ZYPP Patch Number 7373)	Nessus	SuSE Local Security Checks	medium
53827	SuSE 11.1 Security Update : vsftpd (SAT Patch Number 4114)	Nessus	SuSE Local Security Checks	medium
53825	openSUSE Security Update : vsftpd (openSUSE-SU-2011:0435-1)	Nessus	SuSE Local Security Checks	medium
53823	SuSE9 Security Update : vsftpd (YOU Patch Number 12690)	Nessus	SuSE Local Security Checks	medium
53222	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : vsftpd vulnerability (USN-1098-1)	Nessus	Ubuntu Local Security Checks	medium
52747	Mandriva Linux Security Advisory : vsftpd (MDVSA-2011:049)	Nessus	Mandriva Local Security Checks	medium
52704	vsftpd vsf_filename_passes_filter Function Denial of Service	Nessus	FTP	medium
52675	Fedora 15 : vsftpd-2.3.4-1.fc15 (2011-2567)	Nessus	Fedora Local Security Checks	medium
52663	Fedora 13 : vsftpd-2.3.4-1.fc13 (2011-2615)	Nessus	Fedora Local Security Checks	medium
52662	Fedora 14 : vsftpd-2.3.4-1.fc14 (2011-2590)	Nessus	Fedora Local Security Checks	medium
52617	CentOS 4 / 5 : vsftpd (CESA-2011:0337)	Nessus	CentOS Local Security Checks	medium
52608	RHEL 4 / 5 / 6 : vsftpd (RHSA-2011:0337)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-0762

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium