CVE-2005-0256 in Solaris
Summary
by MITRE
The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/05/2025
The vulnerability identified as CVE-2005-0256 represents a critical denial of service flaw within the wu-ftpd FTP server implementation. This issue specifically affects versions 2.6.1 and 2.6.2 of the wu-ftpd software, which was widely deployed in enterprise and organizational environments during the mid-2000s era. The vulnerability stems from improper handling of glob pattern matching within the wu_fnmatch function, which is responsible for processing wildcard characters in directory listings and file operations. The flaw manifests when remote attackers submit specially crafted glob patterns containing an excessive number of asterisk characters, creating a recursive processing scenario that consumes disproportionate system resources.
The technical implementation of this vulnerability resides in the wu_fnmatch.c source file where the wu_fnmatch function processes pattern matching operations without adequate recursion depth limits or resource consumption monitoring. When a glob pattern containing numerous consecutive wildcard characters is processed, the function enters an exponential recursion pattern that rapidly consumes CPU cycles and memory resources. This recursive behavior is particularly problematic during directory listing operations, as demonstrated through the dir command exploitation method. The pattern matching algorithm fails to implement proper bounds checking or maximum recursion limits, allowing attackers to craft patterns that trigger unlimited recursive calls within the function's internal processing logic.
The operational impact of this vulnerability extends beyond simple service disruption, as it can be exploited to exhaust system resources and potentially render the entire FTP service unavailable to legitimate users. Attackers can repeatedly submit malicious glob patterns through the dir command, causing sustained CPU exhaustion that may require system reboot to resolve. The vulnerability affects system availability by consuming computational resources that could otherwise be used for legitimate FTP operations, creating a persistent denial of service condition. This type of resource exhaustion attack specifically targets the process execution model of the FTP server, where each malicious pattern processing consumes increasing amounts of CPU time proportional to the pattern complexity.
Mitigation strategies for this vulnerability require both immediate patching and operational hardening measures. The most effective solution involves updating to a patched version of wu-ftpd that implements proper recursion limits and pattern validation within the wu_fnmatch function. Organizations should implement input validation controls that limit the complexity of glob patterns accepted by the FTP server, particularly restricting the number of consecutive wildcard characters in user-supplied patterns. Network-level controls such as rate limiting and connection throttling can help reduce the impact of repeated malicious requests. Additionally, implementing proper monitoring and alerting for unusual CPU consumption patterns can help detect exploitation attempts. This vulnerability aligns with CWE-121, which addresses buffer overflow conditions, and relates to ATT&CK technique T1499.004 for network denial of service attacks, demonstrating how improper input validation can lead to system-wide availability compromises.