4

CVE-2011-0418

Exploit
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pureftpd ≫ Pure-ftpd Version <= 1.0.31
Pureftpd ≫ Pure-ftpd Version0.90
Pureftpd ≫ Pure-ftpd Version0.91
Pureftpd ≫ Pure-ftpd Version0.92
Pureftpd ≫ Pure-ftpd Version0.93
Pureftpd ≫ Pure-ftpd Version0.94
Pureftpd ≫ Pure-ftpd Version0.95
Pureftpd ≫ Pure-ftpd Version0.95-pre1
Pureftpd ≫ Pure-ftpd Version0.95-pre2
Pureftpd ≫ Pure-ftpd Version0.95-pre3
Pureftpd ≫ Pure-ftpd Version0.95-pre4
Pureftpd ≫ Pure-ftpd Version0.95.1
Pureftpd ≫ Pure-ftpd Version0.95.2
Pureftpd ≫ Pure-ftpd Version0.96
Pureftpd ≫ Pure-ftpd Version0.96.1
Pureftpd ≫ Pure-ftpd Version0.96pre1
Pureftpd ≫ Pure-ftpd Version0.97-final
Pureftpd ≫ Pure-ftpd Version0.97.1
Pureftpd ≫ Pure-ftpd Version0.97.2
Pureftpd ≫ Pure-ftpd Version0.97.3
Pureftpd ≫ Pure-ftpd Version0.97.4
Pureftpd ≫ Pure-ftpd Version0.97.5
Pureftpd ≫ Pure-ftpd Version0.97.6
Pureftpd ≫ Pure-ftpd Version0.97.7
Pureftpd ≫ Pure-ftpd Version0.97.7pre1
Pureftpd ≫ Pure-ftpd Version0.97.7pre2
Pureftpd ≫ Pure-ftpd Version0.97.7pre3
Pureftpd ≫ Pure-ftpd Version0.97pre1
Pureftpd ≫ Pure-ftpd Version0.97pre2
Pureftpd ≫ Pure-ftpd Version0.97pre3
Pureftpd ≫ Pure-ftpd Version0.97pre4
Pureftpd ≫ Pure-ftpd Version0.97pre5
Pureftpd ≫ Pure-ftpd Version0.98-final
Pureftpd ≫ Pure-ftpd Version0.98.1
Pureftpd ≫ Pure-ftpd Version0.98.2
Pureftpd ≫ Pure-ftpd Version0.98.2a
Pureftpd ≫ Pure-ftpd Version0.98.3
Pureftpd ≫ Pure-ftpd Version0.98.4
Pureftpd ≫ Pure-ftpd Version0.98.5
Pureftpd ≫ Pure-ftpd Version0.98.6
Pureftpd ≫ Pure-ftpd Version0.98.7
Pureftpd ≫ Pure-ftpd Version0.98pre1
Pureftpd ≫ Pure-ftpd Version0.98pre2
Pureftpd ≫ Pure-ftpd Version0.99
Pureftpd ≫ Pure-ftpd Version0.99.1
Pureftpd ≫ Pure-ftpd Version0.99.1a
Pureftpd ≫ Pure-ftpd Version0.99.1b
Pureftpd ≫ Pure-ftpd Version0.99.2
Pureftpd ≫ Pure-ftpd Version0.99.2a
Pureftpd ≫ Pure-ftpd Version0.99.3
Pureftpd ≫ Pure-ftpd Version0.99.4
Pureftpd ≫ Pure-ftpd Version0.99.9
Pureftpd ≫ Pure-ftpd Version0.99a
Pureftpd ≫ Pure-ftpd Version0.99b
Pureftpd ≫ Pure-ftpd Version0.99pre1
Pureftpd ≫ Pure-ftpd Version0.99pre2
Pureftpd ≫ Pure-ftpd Version1.0.0
Pureftpd ≫ Pure-ftpd Version1.0.1
Pureftpd ≫ Pure-ftpd Version1.0.2
Pureftpd ≫ Pure-ftpd Version1.0.3
Pureftpd ≫ Pure-ftpd Version1.0.4
Pureftpd ≫ Pure-ftpd Version1.0.5
Pureftpd ≫ Pure-ftpd Version1.0.6
Pureftpd ≫ Pure-ftpd Version1.0.7
Pureftpd ≫ Pure-ftpd Version1.0.8
Pureftpd ≫ Pure-ftpd Version1.0.9
Pureftpd ≫ Pure-ftpd Version1.0.10
Pureftpd ≫ Pure-ftpd Version1.0.11
Pureftpd ≫ Pure-ftpd Version1.0.12
Pureftpd ≫ Pure-ftpd Version1.0.13a
Pureftpd ≫ Pure-ftpd Version1.0.14
Pureftpd ≫ Pure-ftpd Version1.0.15
Pureftpd ≫ Pure-ftpd Version1.0.16a
Pureftpd ≫ Pure-ftpd Version1.0.16b
Pureftpd ≫ Pure-ftpd Version1.0.16c
Pureftpd ≫ Pure-ftpd Version1.0.17
Pureftpd ≫ Pure-ftpd Version1.0.17a
Pureftpd ≫ Pure-ftpd Version1.0.18
Pureftpd ≫ Pure-ftpd Version1.0.19
Pureftpd ≫ Pure-ftpd Version1.0.20
Pureftpd ≫ Pure-ftpd Version1.0.21
Pureftpd ≫ Pure-ftpd Version1.0.22
Pureftpd ≫ Pure-ftpd Version1.0.24
Pureftpd ≫ Pure-ftpd Version1.0.25
Pureftpd ≫ Pure-ftpd Version1.0.26
Pureftpd ≫ Pure-ftpd Version1.0.27
Pureftpd ≫ Pure-ftpd Version1.0.28
Pureftpd ≫ Pure-ftpd Version1.0.29
Pureftpd ≫ Pure-ftpd Version1.0.30
Netbsd ≫ Netbsd Version5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.26% 0.935
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://securityreason.com/achievement_securityalert/97
Exploit
http://www.pureftpd.org/project/pure-ftpd/news
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c#rev1.28
Patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c.diff?r1=1.27&r2=1.28&f=h
Patch
http://securityreason.com/securityalert/8228
http://www.mandriva.com/security/advisories?name=MDVSA-2011:094
http://www.securityfocus.com/bid/47671
Exploit
http://www.vupen.com/english/advisories/2011/1273
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=704283