4

CVE-2010-4755

Exploit
The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSH_FXP_STAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openbsd ≫ Openssh Version <= 5.8
Openbsd ≫ Openssh Version 1.2
Openbsd ≫ Openssh Version 1.2.1
Openbsd ≫ Openssh Version 1.2.2
Openbsd ≫ Openssh Version 1.2.3
Openbsd ≫ Openssh Version 1.2.27
Openbsd ≫ Openssh Version 1.3
Openbsd ≫ Openssh Version 1.5
Openbsd ≫ Openssh Version 1.5.7
Openbsd ≫ Openssh Version 1.5.8
Openbsd ≫ Openssh Version 2.1
Openbsd ≫ Openssh Version 2.1.1
Openbsd ≫ Openssh Version 2.2
Openbsd ≫ Openssh Version 2.3
Openbsd ≫ Openssh Version 2.3.1
Openbsd ≫ Openssh Version 2.5
Openbsd ≫ Openssh Version 2.5.1
Openbsd ≫ Openssh Version 2.5.2
Openbsd ≫ Openssh Version 2.9
Openbsd ≫ Openssh Version 2.9.9
Openbsd ≫ Openssh Version 2.9.9p2
Openbsd ≫ Openssh Version 2.9p1
Openbsd ≫ Openssh Version 2.9p2
Openbsd ≫ Openssh Version 3.0
Openbsd ≫ Openssh Version 3.0.1
Openbsd ≫ Openssh Version 3.0.1p1
Openbsd ≫ Openssh Version 3.0.2
Openbsd ≫ Openssh Version 3.0.2p1
Openbsd ≫ Openssh Version 3.0p1
Openbsd ≫ Openssh Version 3.1
Openbsd ≫ Openssh Version 3.1p1
Openbsd ≫ Openssh Version 3.2
Openbsd ≫ Openssh Version 3.2.2
Openbsd ≫ Openssh Version 3.2.2p1
Openbsd ≫ Openssh Version 3.2.3p1
Openbsd ≫ Openssh Version 3.3
Openbsd ≫ Openssh Version 3.3p1
Openbsd ≫ Openssh Version 3.4
Openbsd ≫ Openssh Version 3.4p1
Openbsd ≫ Openssh Version 3.5
Openbsd ≫ Openssh Version 3.5p1
Openbsd ≫ Openssh Version 3.6
Openbsd ≫ Openssh Version 3.6.1
Openbsd ≫ Openssh Version 3.6.1p1
Openbsd ≫ Openssh Version 3.6.1p2
Openbsd ≫ Openssh Version 3.7
Openbsd ≫ Openssh Version 3.7.1
Openbsd ≫ Openssh Version 3.7.1p1
Openbsd ≫ Openssh Version 3.7.1p2
Openbsd ≫ Openssh Version 3.8
Openbsd ≫ Openssh Version 3.8.1
Openbsd ≫ Openssh Version 3.8.1p1
Openbsd ≫ Openssh Version 3.9
Openbsd ≫ Openssh Version 3.9.1
Openbsd ≫ Openssh Version 3.9.1p1
Openbsd ≫ Openssh Version 4.0
Openbsd ≫ Openssh Version 4.0p1
Openbsd ≫ Openssh Version 4.1
Openbsd ≫ Openssh Version 4.1p1
Openbsd ≫ Openssh Version 4.2
Openbsd ≫ Openssh Version 4.2p1
Openbsd ≫ Openssh Version 4.3
Openbsd ≫ Openssh Version 4.3p1
Openbsd ≫ Openssh Version 4.3p2
Openbsd ≫ Openssh Version 4.4
Openbsd ≫ Openssh Version 4.4p1
Openbsd ≫ Openssh Version 4.5
Openbsd ≫ Openssh Version 4.6
Openbsd ≫ Openssh Version 4.7
Openbsd ≫ Openssh Version 4.7p1
Openbsd ≫ Openssh Version 4.8
Openbsd ≫ Openssh Version 4.9
Openbsd ≫ Openssh Version 5.0
Openbsd ≫ Openssh Version 5.1
Openbsd ≫ Openssh Version 5.2
Openbsd ≫ Openssh Version 5.3
Openbsd ≫ Openssh Version 5.4
Openbsd ≫ Openssh Version 5.5
Openbsd ≫ Openssh Version 5.6
Openbsd ≫ Openssh Version 5.7
Freebsd ≫ Freebsd Version 7.3
Freebsd ≫ Freebsd Version 8.1
Netbsd ≫ Netbsd Version 5.0.2
Openbsd ≫ Openbsd Version 4.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.79% 0.939
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:N/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://securityreason.com/achievement_securityalert/89
Exploit
http://cxib.net/stuff/glob-0day.c
Exploit
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-008.txt.asc
Vendor Advisory
http://securityreason.com/exploitalert/9223
Exploit
http://securityreason.com/securityalert/8116
http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c#rev1.13.12.1
Patch
http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp.c#rev1.21.6.1
Patch