CVE-2011-0762
Fixed in a distro release EPSS 74%
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
Products: vsftpd_project vsftpd, canonical ubuntu_linux, fedoraproject fedora, debian_linux, opensuse, suse linux_enterprise_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | vsftpd | 2.3.4-1 |
| Debian 13 | vsftpd | 2.3.4-1 |
| Debian 14 | vsftpd | 2.3.4-1 |
| Debian 5.0 | vsftpd | 2.0.7-1+lenny1 |
| Debian 6.0 | vsftpd | 2.3.2-3+squeeze2 |
| Red Hat Enterprise Linux 4 | vsftpd | 0:2.0.1-9.el4 |
| Red Hat Enterprise Linux 4 | vsftpd-debuginfo | 0:2.0.1-9.el4 |
| Red Hat Enterprise Linux 5 | vsftpd | 0:2.0.5-16.el5_6.1 |
| Red Hat Enterprise Linux 5 | vsftpd-debuginfo | 0:2.0.5-16.el5_6.1 |
| Red Hat Enterprise Linux 6 | vsftpd | 0:2.2.2-6.el6_0.1 |
| Red Hat Enterprise Linux 6 | vsftpd-debuginfo | 0:2.2.2-6.el6_0.1 |