4

CVE-2011-0418

Exploit
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pureftpd ≫ Pure-ftpd Version <= 1.0.31
Pureftpd ≫ Pure-ftpd Version 0.90
Pureftpd ≫ Pure-ftpd Version 0.91
Pureftpd ≫ Pure-ftpd Version 0.92
Pureftpd ≫ Pure-ftpd Version 0.93
Pureftpd ≫ Pure-ftpd Version 0.94
Pureftpd ≫ Pure-ftpd Version 0.95
Pureftpd ≫ Pure-ftpd Version 0.95-pre1
Pureftpd ≫ Pure-ftpd Version 0.95-pre2
Pureftpd ≫ Pure-ftpd Version 0.95-pre3
Pureftpd ≫ Pure-ftpd Version 0.95-pre4
Pureftpd ≫ Pure-ftpd Version 0.95.1
Pureftpd ≫ Pure-ftpd Version 0.95.2
Pureftpd ≫ Pure-ftpd Version 0.96
Pureftpd ≫ Pure-ftpd Version 0.96.1
Pureftpd ≫ Pure-ftpd Version 0.96pre1
Pureftpd ≫ Pure-ftpd Version 0.97-final
Pureftpd ≫ Pure-ftpd Version 0.97.1
Pureftpd ≫ Pure-ftpd Version 0.97.2
Pureftpd ≫ Pure-ftpd Version 0.97.3
Pureftpd ≫ Pure-ftpd Version 0.97.4
Pureftpd ≫ Pure-ftpd Version 0.97.5
Pureftpd ≫ Pure-ftpd Version 0.97.6
Pureftpd ≫ Pure-ftpd Version 0.97.7
Pureftpd ≫ Pure-ftpd Version 0.97.7pre1
Pureftpd ≫ Pure-ftpd Version 0.97.7pre2
Pureftpd ≫ Pure-ftpd Version 0.97.7pre3
Pureftpd ≫ Pure-ftpd Version 0.97pre1
Pureftpd ≫ Pure-ftpd Version 0.97pre2
Pureftpd ≫ Pure-ftpd Version 0.97pre3
Pureftpd ≫ Pure-ftpd Version 0.97pre4
Pureftpd ≫ Pure-ftpd Version 0.97pre5
Pureftpd ≫ Pure-ftpd Version 0.98-final
Pureftpd ≫ Pure-ftpd Version 0.98.1
Pureftpd ≫ Pure-ftpd Version 0.98.2
Pureftpd ≫ Pure-ftpd Version 0.98.2a
Pureftpd ≫ Pure-ftpd Version 0.98.3
Pureftpd ≫ Pure-ftpd Version 0.98.4
Pureftpd ≫ Pure-ftpd Version 0.98.5
Pureftpd ≫ Pure-ftpd Version 0.98.6
Pureftpd ≫ Pure-ftpd Version 0.98.7
Pureftpd ≫ Pure-ftpd Version 0.98pre1
Pureftpd ≫ Pure-ftpd Version 0.98pre2
Pureftpd ≫ Pure-ftpd Version 0.99
Pureftpd ≫ Pure-ftpd Version 0.99.1
Pureftpd ≫ Pure-ftpd Version 0.99.1a
Pureftpd ≫ Pure-ftpd Version 0.99.1b
Pureftpd ≫ Pure-ftpd Version 0.99.2
Pureftpd ≫ Pure-ftpd Version 0.99.2a
Pureftpd ≫ Pure-ftpd Version 0.99.3
Pureftpd ≫ Pure-ftpd Version 0.99.4
Pureftpd ≫ Pure-ftpd Version 0.99.9
Pureftpd ≫ Pure-ftpd Version 0.99a
Pureftpd ≫ Pure-ftpd Version 0.99b
Pureftpd ≫ Pure-ftpd Version 0.99pre1
Pureftpd ≫ Pure-ftpd Version 0.99pre2
Pureftpd ≫ Pure-ftpd Version 1.0.0
Pureftpd ≫ Pure-ftpd Version 1.0.1
Pureftpd ≫ Pure-ftpd Version 1.0.2
Pureftpd ≫ Pure-ftpd Version 1.0.3
Pureftpd ≫ Pure-ftpd Version 1.0.4
Pureftpd ≫ Pure-ftpd Version 1.0.5
Pureftpd ≫ Pure-ftpd Version 1.0.6
Pureftpd ≫ Pure-ftpd Version 1.0.7
Pureftpd ≫ Pure-ftpd Version 1.0.8
Pureftpd ≫ Pure-ftpd Version 1.0.9
Pureftpd ≫ Pure-ftpd Version 1.0.10
Pureftpd ≫ Pure-ftpd Version 1.0.11
Pureftpd ≫ Pure-ftpd Version 1.0.12
Pureftpd ≫ Pure-ftpd Version 1.0.13a
Pureftpd ≫ Pure-ftpd Version 1.0.14
Pureftpd ≫ Pure-ftpd Version 1.0.15
Pureftpd ≫ Pure-ftpd Version 1.0.16a
Pureftpd ≫ Pure-ftpd Version 1.0.16b
Pureftpd ≫ Pure-ftpd Version 1.0.16c
Pureftpd ≫ Pure-ftpd Version 1.0.17
Pureftpd ≫ Pure-ftpd Version 1.0.17a
Pureftpd ≫ Pure-ftpd Version 1.0.18
Pureftpd ≫ Pure-ftpd Version 1.0.19
Pureftpd ≫ Pure-ftpd Version 1.0.20
Pureftpd ≫ Pure-ftpd Version 1.0.21
Pureftpd ≫ Pure-ftpd Version 1.0.22
Pureftpd ≫ Pure-ftpd Version 1.0.24
Pureftpd ≫ Pure-ftpd Version 1.0.25
Pureftpd ≫ Pure-ftpd Version 1.0.26
Pureftpd ≫ Pure-ftpd Version 1.0.27
Pureftpd ≫ Pure-ftpd Version 1.0.28
Pureftpd ≫ Pure-ftpd Version 1.0.29
Pureftpd ≫ Pure-ftpd Version 1.0.30
Netbsd ≫ Netbsd Version 5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 7.26% 0.935
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://securityreason.com/achievement_securityalert/97
Exploit
http://www.pureftpd.org/project/pure-ftpd/news
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c#rev1.28
Patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gen/glob.c.diff?r1=1.27&r2=1.28&f=h
Patch
http://securityreason.com/securityalert/8228
http://www.mandriva.com/security/advisories?name=MDVSA-2011:094
http://www.securityfocus.com/bid/47671
Exploit
http://www.vupen.com/english/advisories/2011/1273
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=704283