CVE-2001-0247

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 19.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2001-06-18 · updated 2026-06-16

Description

Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3.

Affected products

FreeBSD: 2.2, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6 (+12)
MIT Kerberos 5: 1.1.1, 1.2, 1.2.1, 1.2.2
Netbsd: 1.2.1, 1.3, 1.3.1, 1.3.2, 1.3.3, 1.4 (+4)
OpenBSD: 2.3, 2.4, 2.5, 2.6, 2.7, 2.8
Sgi Irix: 6.1, 6.5.1, 6.5.2m, 6.5.3, 6.5.3f, 6.5.3m (+7)

References

http://archives.neohapsis.com/archives/freebsd/2001-04/0466.html
http://www.cert.org/advisories/CA-2001-07.html
http://www.nai.com/research/covert/advisories/048.asp
http://www.securityfocus.com/bid/2548
https://exchange.xforce.ibmcloud.com/vulnerabilities/6332
http://archives.neohapsis.com/archives/freebsd/2001-04/0466.html
http://www.cert.org/advisories/CA-2001-07.html
http://www.nai.com/research/covert/advisories/048.asp

Get alerted when CVE-2001-0247 or the next vulnerability affects your stack