What’s Vulnerable › Vulnerabilities

CVE-2011-0762

• Severity: medium (CVSS 4.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 73.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2011-03-02 · updated 2026-06-16
• Weakness: CWE-400

Description

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

Affected products

• Canonical Ubuntu Linux: 6.06, 8.04, 9.10, 10.04, 10.10
• Debian Linux: 5.0, 6.0, 7.0
• Fedoraproject Fedora: 13, 14, 15
• Opensuse: 11.2, 11.3, 11.4
• SUSE Linux Enterprise Server: 9, 10-sp3, 10-sp4, 11-sp1
• Vsftpd Project Vsftpd: before 2.3.3 — fixed in 2.3.3

How to fix

Upgrade to a fixed version: Vsftpd Project Vsftpd 2.3.3. Check the vendor advisory for mitigations.

References

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622741
• http://cxib.net/stuff/vspoc232.c
• http://jvn.jp/en/jp/JVN37417423/index.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055881.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055882.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055957.html
• http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
• http://marc.info/?l=bugtraq&m=133226187115472&w=2
• http://securityreason.com/achievement_securityalert/95
• http://securityreason.com/securityalert/8109
• http://www.debian.org/security/2011/dsa-2305

Get alerted when CVE-2011-0762 or the next vulnerability affects your stack